1696 matches found
EUVD-2026-121277
A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to obtain sensitive information and tamper with device configuration, including administrator credentials, without authenticating to the device. This...
CVE-2026-123180 Missing Authentication Vulnerability in NETGEAR Nighthawk RAX30 models
A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to obtain sensitive information and tamper with device configuration, including administrator credentials, without authenticating to the device. This...
PT-2026-141796
Name of the Vulnerable Software and Affected Versions NETGEAR RAX30 versions prior to 1.0.15.110 Description A missing authentication issue allows a network-adjacent attacker who has authenticated to the wifi network to obtain sensitive information and tamper with device configuration, including...
CVE-2026-115213
The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator...
EUVD-2026-119819
The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator...
ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...
ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...
Progress Software WS_FTP Server authorization issue vulnerability
Security vulnerabilities exist in Progress Software WSFTP Server versions prior to 2024.0.6 and prior to 2025.0.3. These vulnerabilities stem from improper authentication and may allow unauthenticated remote attackers to access sensitive information, including administrator credentials...
CVE-2026-107671
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification...
EUVD-2026-111120
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification...
CVE-2026-107671
An attacker possessing valid Administrator credentials can bypass multi-factor authentication (MFA) . This is achieved by globally disabling MFA before completing the verification process. The vulnerability is associated with CWE-288 (Authentication Bypass Using an Alternate Path or Channel). No ...
CVE-2026-107671
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification...
Veeam ONE < 13.1.0.7940 (kb4951)
The version of Veeam ONE installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the kb4951 advisory. - A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it...
Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1
Issue Details CVE-2026-107671 A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification. Severity: High CVSS v4.0 Score: 8.5CVSS: AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:...
CVE-2026-107671: Authentication Bypass Using an Alternate Path or Channel
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification...
ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...
Berri AI LiteLLM permission and access control vulnerability
A security vulnerability exists in Berri AI LiteLLM versions from 1.87.0 up to and including 1.100.4, from 1.101.0 up to and including 1.101.3, from 1.102.0 up to and including 1.102.2, from 1.103.0 up to and including 1.103.1, and from 1.104.0-rc.1 up to and including 1.104.0-rc.2. This...
CVE-2026-43854
A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices...
