EUVD-2026-56982

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and...

EUVD-2026-56981

The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...

PT-2026-71035

POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system...

VulnCheck KEV: CVE-2026-55040

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-71112

A user with access to a valid SAML response may impersonate another user under specific conditions...

PT-2026-71279

Name of the Vulnerable Software and Affected Versions Dell Display and Peripheral Manager DDPM Windows versions prior to 2.3.0.17 Description An authentication bypass by spoofing allows a low privileged attacker with local access to achieve elevation of privileges and execute arbitrary code...

PT-2026-71281

Name of the Vulnerable Software and Affected Versions Dell Display and Peripheral Manager DDPM Windows versions prior to 2.3.0.17 Description An authentication bypass by spoofing allows a low privileged attacker with local access to achieve elevation of privileges and execute arbitrary code...

PT-2026-71350

Name of the Vulnerable Software and Affected Versions WolfStack versions prior to 25.9.2 Description A hard-coded cluster-authentication secret is compiled into every build and published as a constant in src/auth/mod.rs. This allows remote unauthenticated attackers to bypass authentication by...

PT-2026-71107

Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description A Project Resource Manager may gain broader administrative privileges under specific conditions, leading to privilege escalation. Recommendations At the moment, there is no...

PT-2026-71100

Credentials for a deleted user may remain valid for a short period under specific conditions...

PT-2026-71062

Name of the Vulnerable Software and Affected Versions FortiWeb versions 8.0.0 through 8.0.2 FortiWeb versions 7.6.0 through 7.6.5 FortiWeb versions 7.4.x FortiWeb versions 7.2.x FortiWeb versions 7.0.x Description An incomplete list of disallowed inputs may allow an attacker to achieve improper...

Linux Distros Unpatched Vulnerability : CVE-2026-73241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an...

PT-2026-71075

Name of the Vulnerable Software and Affected Versions CryptoPro Secure Disk for Bitlocker versions prior to 7.7.4 Description The bootxsa.efi component fails to properly validate LUKS Linux Unified Key Setup encryption. When encryption is detected, the system skips all CryptoPro file integrity...

PT-2026-71251

SiYuan versions = v3.7.2 patched in v3.7.4 contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1 for a specific set of endpoints including /api/system/exit,...

PT-2026-71159

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can bypass security restrictions because the system does not properly validate session tokens. A session token is a unique identifier used by a server to recognize a...

PT-2026-71129

A holder of a valid integration credential may impersonate other users under specific conditions...

PT-2026-71303

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

PT-2026-71174

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...

PT-2026-71218

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...

PT-2026-70975

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by...