CVE-2026-22620

The CVE-2026-22620 entry concerns Eaton’s Tripp Lite series PADM firmware, where the authentication component allows improper input validation. The issue enables an unauthenticated remote attacker to bypass authentication and gain privileged user access to the device. Details across connected rec...

CVE-2026-22620

Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device...

CVE-2026-22620

Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization during client update handling. An attacker can persist a confidential client that does...

CVE-2026-18362 DFIR-IRIS Missing Brute Force Protection in User Authentication

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...

CVE-2026-18362 DFIR-IRIS Missing Brute Force Protection in User Authentication

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...

EUVD-2026-51073

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...

CVE-2026-18362

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...

CVE-2026-18362

CVE-2026-18362 concerns the IRIS web application (noted in version 2.4.26 and possibly other revisions) that does not protect user authentication against brute-force attacks. The connected sources confirm the affected software and the underlying issue but do not provide details on exploit vectors...

CVE-2026-16971 DFIR-IRIS Missing Brute Force Protection in OTP Validation

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...

CVE-2026-16971

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...

CVE-2026-16971 DFIR-IRIS Missing Brute Force Protection in OTP Validation

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...

EUVD-2026-51072

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...

CVE-2026-44101

Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and confidential data being disclosed to the attacker...

CVE-2026-44105

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted...

CVE-2026-44090

Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised...

CLEANSTART-2026-ZB20397 Security fixes in kubernetes-dashboard-auth-fips 1.4.0-r2

Package kubernetes-dashboard-auth-fips version 1.4.0-r2 fixes 21 vulnerabilities: CVE-2026-27143, CVE-2026-27140, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...

SUSE-SU-2026:3419-1 Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

Grafana Snapshot - Authentication Bypass

Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by...

EUVD-2026-51041

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted...