210809 matches found
CVE-2026-110924
Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553...
CVE-2026-110924
Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553...
UBUNTU-CVE-2026-110924
Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553...
CVE-2026-110746 CVE-2026-110746
A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM...
Microsoft Identity Web Elevation of Privilege Vulnerability
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network...
CVE-2026-110924
A vulnerability exists in OpenSSH when GSSAPI authentication is enabled. A failed GSSAPI authentication attempt can cause delegated credentials to remain stored for the connection, even if the user authorization fails. Consequently, a subsequent successful login on that same connection may be imp...
CVE-2026-110924
A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state...
CVE-2026-110924
A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state...
Information Exposure
Overview org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server. Affected versions of this package are vulnerable to Information Exposure in the HttpClient. An attacker can obtain proxy authentication credentials by crafting a server that responds with a 407...
Authentication Bypass Using an Alternate Path or Channel
Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the EthereumAuthenticator process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later...
Authentication Bypass Using an Alternate Path or Channel
Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the EthereumAuthenticator process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later...
Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance
Summary Vulnerabilities identified in the IBM Netezza Appliance have been remediated in the latest security patch releases of NPS and Callhome. Vulnerability Details CVEID:CVE-2026-1965 DESCRIPTION: libcurl can in some circumstances reuse the wrong connection when asked to do an...
Exploit for CVE-2026-18963
CVE-2026-18963 A proof of concept and vulnerability checker f...
CVE-2026-41940
CVE-2026-41940: cPanel/WHM Authentication Bypass Single & Multi-Target Disclaimer: This document and the associated script exploit.py are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or d...
CVE-2026-41940
CVE-2026-41940: cPanel/WHM Authentication Bypass Single & Multi-Target Disclaimer: This document and the associated script exploit.py are provided strictly for educational purposes, security research, and authorized penetration testing. Do not use this software against systems you do not own or d...
PYSEC-2026-4247 PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
Call API localhost-only authentication bypass via spoofed Host header Summary PraisonAI's patched PRAISONAICALLAUTH=disabled safeguard for the n8n/call agent invocation API can be bypassed with a spoofed Host: 127.0.0.1 header, allowing an unauthenticated network caller to list and invoke...
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
Call API localhost-only authentication bypass via spoofed Host header SummaryPraisonAI's patched PRAISONAICALLAUTH=disabled safeguard for the n8n/call agent invocation API can be bypassed with a spoofed Host: 127.0.0.1 header, allowing an unauthenticated network caller to list and invoke register...
PYSEC-2026-4315 wger: API credentials remain valid after logout/password change
Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...
PYSEC-2026-4233 Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
Summary A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False. This allows a remote attacker who knows a flow's UUID ...