EUVD-2026-51381

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...

CVE-2026-14541 Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...

CVE-2026-14541

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...

CVE-2026-14541 Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...

SUSE CVE-2026-17681

Insufficient validation of untrusted input in Web Authentication in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-52134

CVE-2026-52134 affects libiec61850 v1.6, in the parseGoosePayload() function (/goose/goose_receiver.c). The issue allows bypassing authentication via captured GOOSE frames due to inadequate handling of replayed/stale frames in the GOOSE subscriber path, potentially delivering older state data to ...

PT-2026-66861

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.15.0 Description An authorization bypass exists in servers using the --mobility configuration. The system authenticates a resumed REFRESH request using the resuming user's credentials but fails to verify that identit...

PT-2026-66765

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

CVE-2026-51953

An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components...

CVE-2026-51953

Summary of CVE-2026-51953 (FeehiCMS v2.1.1) : A privilege-escalation vulnerability exists in FeehiCMS affecting the Session management module, authentication logic, and logout handler. The issue allows an attacker to escalate privileges within the application. The NVD/NIST entry lists CVSSv3.1 ba...

PT-2026-66753

Name of the Vulnerable Software and Affected Versions gnome-remote-desktop as shipped in Red Hat Enterprise Linux affected versions not specified Description A flaw exists when the daemon operates in system mode with RDP enabled. The incoming connection handler bypasses the connection throttler,...

JFrog Artifactory < 7.111.18 / 7.117.x < 7.117.25 / 7.125.x < 7.125.18 / 7.133.x < 7.133.27 / 7.146.x < 7.146.34 / 7.161.x < 7.161.15 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is affected by multiple vulnerabilities: - A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and...

Progress MOVEit Transfer < 2025.1.5 / 2026.0.x < 2026.0.3 Multiple Vulnerabilities (July 2026)

The version of Progress MOVEit Transfer installed on the remote host is prior to 2025.1.5 or 2026.0.x prior to 2026.0.3. It is, therefore, affected by multiple vulnerabilities: - Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. CVE-2026-159...

The vulnerability of the Portainer container management platform, related to the improper implementation of authentication algorithms, allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the Portainer container management platform is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability allows an attacker to bypass security restrictions and gain unauthorized access to protected information...

PT-2026-66773

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga login required decorator; the application's before request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication...

CVE-2026-52134

An issue in the parseGoosePayload function /goose/goosereceiver.c of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame...

PT-2026-66864

Name of the Vulnerable Software and Affected Versions libiec61850 version 1.6 Description An issue exists in the parseGoosePayload function located in /goose/goose receiver.c that allows attackers to bypass authentication by using a captured GOOSE frame. GOOSE Generic Object Oriented Substation...

PT-2026-66863

Name of the Vulnerable Software and Affected Versions FeehiCMS version 2.1.1 Description An issue exists in the Session management module, authentication logic, and logout handler components that allows an attacker to escalate privileges. Recommendations At the moment, there is no information abo...

The vulnerability in the web-based authentication interface of the Cisco Secure FMC Software allows a perpetrator to escalate their privileges.

The vulnerability in the web-based authentication interface of the Cisco Secure FMC Software for managing network security devices is related to the use of strictly encrypted login credentials. Exploiting this vulnerability can allow a malicious actor to remotely increase their privileges...

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in their authentication procedures, which allow attackers to bypass existing security mechanisms.

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the deficiencies of its authentication procedures. Exploiting this vulnerability could allow attackers to bypass existing security mechanisms remotely...