PT-2026-114929

Name of the Vulnerable Software and Affected Versions OpenSSH affected versions not specified Description When GSSAPI authentication is enabled, a failed GSSAPI attempt may leave delegated credentials stored for the connection despite the failure of user authorization. Consequently, a subsequent...

PT-2026-115208

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.2 Description The LINE backend fails to validate the returned OAuth state during the exchange of an authorization code. This allows an attacker to initiate an authorization flow for an account they...

CVE-2026-104198: Improper Authentication

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

PT-2026-115225

Name of the Vulnerable Software and Affected Versions EnergizeLab Eilik and EilikO affected versions not specified Description The FastAPI AI inference and profiling services lack authentication for AI model administration functions. This allows an unauthenticated remote attacker to modify the AI...

PT-2026-115280

Name of the Vulnerable Software and Affected Versions Archon versions 0.2.13 through 0.11.1 Description Missing authentication allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agen...

PT-2026-115116

Name of the Vulnerable Software and Affected Versions Kuadrant operator affected versions not specified Description A flaw exists in the internal WebAssembly WASM shim used by the operator. The shim fails to correctly escape values from HTTPRoute match fields when generating the Common Expression...

pac4j-jwt 6.3.2 Authentication Bypass

pac4j-jwt version 6.3.2 and earlier affected release lines contain an authentication bypass in JwtAuthenticator when processing encrypted JWTs. The proof of concept creates a JWE-wrapped unsigned JWT with arbitrary claims. https://packetstorm.news/download/235858...

Ivanti Connect Secure Authentication Bypass Code Execution

The vulnerability of the Ivanti Connect Secure network access control tool relates to the ability to bypass authentication through spoofing. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms and execute arbitrary code...

Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130361)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130361 advisory. Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST...

CVE-2026-102764: Authentication Bypass by Spoofing

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance...

WebAssembly code injection vulnerability

WebAssembly contains a code injection vulnerability. This vulnerability arises because the internal WebAssembly WASM shim used by the Kuadrant operator fails to properly escape values within HTTPRoute matching fields when generating CEL predicates. As a result, users capable of creating or...

PT-2026-114995

: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

Keycloak 26.7.1 Reset Credentials Authentication Bypass

Keycloak versions 26.0.0 through 26.7.1 contain an authentication bypass in the reset-credentials flow that can permit an unauthenticated attacker to set a user's password. https://packetstorm.news/download/235836...

Gitea 1.26.2 Reverse Proxy Authentication Bypass

Gitea version 1.26.2 Docker images trust reverse proxy authentication headers from any source, allowing unauthenticated impersonation through X-WEBAUTH-USER. This Docker-based proof of concept provides a CTF environment demonstrating access to a private repository...

PT-2026-115331

A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access...

CVE-2026-110924: Incomplete Cleanup

Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553...

CVE-2026-102946: Authentication Bypass by Spoofing

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

Rocky Linux 10.2 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc Multiple Vulnerabilities (crlsa-2026_80512)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680512 advisory. curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies CVE-2026-6253 curl: libcurl: Authentication bypass due to incorrect HT...

Rocky Linux 9 [CIQ] Security Update: dovecot / dovecot-debuginfo / dovecot-debugsource / dovecot-devel / etc Multiple Vulnerabilities (crlsa-2026_80825)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680825 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorrect...

AlmaLinux 9 : nodejs:24 (ALSA-2026:73838)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:73838 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificate...