CVE-2026-100351

A flaw was found in kin-openapi. An unauthenticated remote attacker can bypass authentication checks on protected routes by sending requests containing encoded path separators. This issue occurs because the request validation handler inspects the decoded URL path, while certain downstream routers...

CVE-2026-102946

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CVE-2026-102946

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CVE-2026-84731

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

USN-8933-1: RabbitMQ Server vulnerabilities

It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker could possibly use this issue to cause a cross-site request forgery attack. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04...

USN-8933-1 rabbitmq-server vulnerabilities

It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker could possibly use this issue to cause a cross-site request forgery attack. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04...

WordPress miniOrange OTP Login, Verification and SMS Notifications plugin <= 5.5.8 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Azgnt in WordPress Plugin miniorange otp verification versions = 5.5.8...

CVE-2026-84731 Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

CVE-2026-84731 Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

EUVD-2026-102206

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

Security Bulletin: Multiple vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository

Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about multiple vulnerabilities affecting WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in...

CVE-2026-45451

: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

CVE-2026-100351

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...

Cassio Santos Whaticket Open Source: Permissions, licensing, and access control issues

Cassio Santos Whaticket Open Source versions from cf04795 onwards have vulnerabilities related to permission and access control. These vulnerabilities stem from authentication bypasses. Unauthenticated attackers can register as administrators by omitting the profile field or setting it to ‘admin’...

WordPress MiniOrange OTP Login, Verification, and SMS Notifications: Authorization Vulnerability

WordPress miniOrange OTP Login, Verification, and SMS Notifications: Versions prior to 5.5.8 have an authorization issue vulnerability. This vulnerability stems from the modelayotpprocess function, which short-circuits the authentication process before password verification or administrator inten...

OpenBMB StaffDeck encryption vulnerabilities

OpenBMB StaffDeck versions 0.5.6 and earlier have an encryption-related vulnerability. This vulnerability stems from an authentication bypass mechanism. The use of a hardcoded default appsecret allows unauthorized attackers to forge administrator session tokens and gain full tenant management...

Microsoft Authentication Library for Node.js Input Validation Vulnerability

The Microsoft Authentication Library for Node.js has a vulnerability related to input validation errors. This vulnerability stems from source validation errors, which may allow unauthorized attackers to leak information through the network...

mlogclub bbs-go authorization issue vulnerability

The mlogclub bbs-go versions 4.4.6 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of verification of the aud claim in the /api/login/googleonetap endpoint, allowing authentication bypass. Attackers can replay victim’s tokens to log in with the victim...

Niefy wx-api authorization issue vulnerability

Niefy wx-api versions 0.8.2 and earlier have an authorization issue vulnerability. This vulnerability stems from an authentication bypass flaw, allowing unverified attackers to impersonate WeChat fans by providing the original openid cookie to fan-oriented controllers. These attackers can then ca...

Apache Kylin authorization issue vulnerability

A security vulnerability exists in Apache Kylin versions 5 through 5.0.4. This vulnerability stems from the lack of authentication in the backend cache API, making it susceptible to SQL injection attacks that could lead to the execution of malicious SQL statements...