PT-2026-71174

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...

PT-2026-71218

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...

PT-2026-70975

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by...

Apache Tomcat 11.0.23 RewriteValve Authentication Bypass

A proof of concept exploit for an authentication bypass vulnerability in Apache Tomcat version 11.0.23. The vulnerability exists because RewriteValve rebuilds decoded request URIs using java.net.URLDecoder, causing literal plus characters to be interpreted differently during security constraint...

PT-2026-71167

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser...

PT-2026-71113

An unauthenticated user may bypass authentication under specific cache conditions...

AlmaLinux 9 : iscsi-initiator-utils (ALSA-2026:53844)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:53844 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

AlmaLinux 10 : iscsi-initiator-utils (ALSA-2026:53845)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:53845 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

RHEL 9 : iscsi-initiator-utils (RHSA-2026:53844)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:53844 advisory. The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as th...

RockyLinux 10 : iscsi-initiator-utils (RLSA-2026:53845)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:53845 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

PT-2026-71059

Name of the Vulnerable Software and Affected Versions FortiWeb versions 8.0.0 through 8.0.2 FortiWeb versions 7.6.0 through 7.6.6 FortiWeb versions 7.4.0 through 7.4.11 FortiWeb versions 7.2.0 through 7.2.12 FortiWeb versions 7.0.0 through 7.0.12 Description An improper authentication issue exist...

PT-2026-71228

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

PT-2026-71094

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

PT-2026-71304

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

PT-2026-71077

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

PT-2026-71192

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can bypass security restrictions due to improper neutralization of special elements in an SQL parameter. This issue occurs when the system fails to correctly sanitize...

RockyLinux 9 : iscsi-initiator-utils (RLSA-2026:53844)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:53844 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

PT-2026-71064

Name of the Vulnerable Software and Affected Versions FortiManager version 7.6.1 FortiManager versions 7.4.3 through 7.4.5 FortiManager versions 7.2.5 through 7.2.9 FortiManager Cloud version 7.6.1 FortiManager Cloud versions 7.4.3 through 7.4.5 FortiManager Cloud versions 7.2.5 through 7.2.9...

PT-2026-71102

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions can access private NuGet metadata under specific conditions. Recommendations At the moment, there is ...

Security Bulletin: IBM Db2 Mirror for i is affected by multiple vulnerabilities

Summary The IBM Db2 Mirror for i GUI is affected by multiple vulnerabilities CVE-2026-17186, CVE-2026-17184, CVE-2026-17182, CVE-2026-17181, CVE-2026-16879, CVE-2026-17179, CVE-2026-16915, CVE-2026-17175, CVE-2026-18554, CVE-2026-17079, CVE-2026-16905, CVE-2026-17227, CVE-2026-17209,...