47892 matches found
OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check
Summary When a SASL PLAIN bind supplies an authorization identity authzid that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIEDAUTH privilege and never evaluated the "proxy" access-control right the mayProxy ACI scope check. As a result, any account holding the...
CVE-2026-61884
Technical details are not publicly available in the provided documents. Monitor for updates from NVD/CVE and trusted advisories to confirm affected versions, root cause specifics, and remediation.
CVE-2026-61884 Tycon Systems TPDIN-Monitor-WEB2 Authentication Bypass Using an Alternate Path or Channel
The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid...
CVE-2026-65708
sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication due to the unconditional substitution of a nil AuthenticationFunc with a no-op function in the Load process. An attacker can gain unauthorized access to protected endpoints by sending unauthenticated requests, as...
CVE-2026-65600
A flaw was found in Traefik. An unauthenticated remote attacker can bypass authentication due to a path traversal vulnerability in the ReplacePathRegex middleware. When this middleware is misconfigured, it forwards un-normalized paths, allowing a backend to resolve them to protected routes and...
CVE-2026-66006
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...
EUVD-2026-48612
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...
CVE-2026-54763
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. The BasicAuth, DigestAuth, and ForwardAuth middlewares in Traefik do not correctly treat underscore-variant header names. This allows a remote attacker to inject a specially crafted header that bypasses Traefik's security...
Vulnerabilities handled in Check Point Security Management products
Check Point has identified vulnerabilities in SmartConsole, Gaia Portal, Security Management, and Multi-Domain Security Management. These vulnerabilities involve authentication bypasses and privilege escalations within various Check Point management components. - In SmartConsole, unauthenticated...
OESA-2026-3148 sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...
OESA-2026-3147 sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...
Exploit for Missing Authentication for Critical Function in Cpanel
No d...
CVE-2026-66139
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...
DEBIAN-CVE-2026-66139
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...
UBUNTU-CVE-2026-66139
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...
CVE-2026-66139
OpenStack Zaqar
CVE-2026-66139
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...
