212119 matches found
CVE-2026-64959
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...
CVE-2026-64959 Apache Kylin: Missing authentication on certain cache API endpoints
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...
CVE-2026-64959 Apache Kylin: Missing authentication on certain cache API endpoints
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...
CVE-2026-64959
Apache Kylin versions 5 through 5.0.4 are vulnerable to SQL Injection and Missing Authentication for Critical Function (CWE-89, CWE-306). The root cause is that certain backend cache API endpoints lack required authentication, allowing for the execution of injected SQL commands. This poses a high...
EUVD-2026-102854
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...
CVE-2026-64959
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...
OESA-2026-4388 libsoup security update
libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: SoupAuthManager caches proxy authentication credentials without scoping them to...
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support formerly Bomgar versions 26.2.3 and earlier. Patches are available for supported versions 24.3.1 and later; organizations using older versions must upgrade first. Cyber threat actor...
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability...
OESA-2026-4330 pulsar security update
Pulsar is a distributed pub-sub messaging platform with a very flexible messaging model and an intuitive client API. Security Fixes: Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable...
OESA-2026-4331 pulsar security update
Pulsar is a distributed pub-sub messaging platform with a very flexible messaging model and an intuitive client API. Security Fixes: Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable...
OESA-2026-4329 pulsar security update
Pulsar is a distributed pub-sub messaging platform with a very flexible messaging model and an intuitive client API. Security Fixes: Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable...
OESA-2026-4324 tomcat security update
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Check for Certificate...
OESA-2026-4323 tomcat security update
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Check for Certificate...
OESA-2026-4321 tomcat security update
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Check for Certificate...
OESA-2026-4322 tomcat security update
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Check for Certificate...
CVE-2026-19864
A flaw was found in Eclipse Jetty. The session authentication mechanism retains user credentials in session objects, which can cause plaintext passwords to be written to persistent storage when authenticated sessions are saved. An attacker with read access to the persistent session data store can...
WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by Anatoly Gorbounov x1will in WordPress Plugin 2Way VideoCalls and Random Chat versions = 6.1.5...
BIT-MARIADB-MIN-2026-107382 MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash...
BIT-GITEA-2026-103059 Gitea built-in SSH server authentication bypass through key case folding
When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...