EUVD-2026-66762

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials...

EUVD-2026-66760

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account...

PT-2026-82592

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate server URLs within the login and register with email functions, allowing the use of unconfigured hosts and unencrypted http:// URLs. This allows attackers...

TBEA TLogger 2.1.0.0B0.0.0.0 Backdoor Account / SQL Injection / Disclosure

TBEA TLogger version 2.1.0.0B0.0.0.0 suffers from a backdoor account, resource exhaustion, denial of service, information disclosure, and remote SQL injection vulnerabilities. ------------------------------------------------------------------------------- title| Multiple Vulnerabilities in TBEA...

PT-2026-82507

Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

PT-2026-86594

Juthawong Naisanguansee discovered that PAM incorrectly cleared failed login attempt records when certain services invoked the account phase without first performing authentication. An attacker could possibly use this issue to reset failed login counters, resulting in authentication lockout...

CVE-2026-76940: Improper Restriction of Excessive Authentication Attempts

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-81691: Cleartext Transmission of Sensitive Information

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-16279: Improper Authorization

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts...

PT-2026-85192

openssl encrypt versions before 1.4.9 fail to validate server URLs in login and register with email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client id, passwords, and JWTs to achieve full...

PT-2026-82508

Name of the Vulnerable Software and Affected Versions 3DPassport in 3DSwymer versions Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x Description An improper authorization issue exists in 3DPassport, which could allow an attacker to gain unauthorized access to certain user account...

Grafana Alloy: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile . Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

PT-2026-82731

Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...

PT-2026-82560

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxi...

PT-2026-82856

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...

CVE-2026-80208: Missing Authentication for Critical Function

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxi...

CVE-2026-11754: Observable Discrepancy

Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

PT-2026-82844

Name of the Vulnerable Software and Affected Versions WatchGuard Dimension affected versions not specified Description WatchGuard Dimension records unredacted session identifiers for logged-in users within its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log t...

PT-2026-82792

Name of the Vulnerable Software and Affected Versions Ebyte NE2-D11 affected versions not specified Description The device fails to restrict repeated authentication attempts because it lacks rate limiting or account lockout mechanisms. This deficiency allows attackers to conduct automated...

CVE-2026-65956

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...