ROS-20260909-73-0168

The vulnerability of the StorageAccessAPI component in Google Chrome and Microsoft Edge is related to authentication errors. Exploiting this vulnerability can allow an attacker to manipulate data integrity through a specially created HTML page...

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to errors in the certificate validation process. This allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to errors in the authentication process. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...

The vulnerability of the Python programming language’s cryptography interpreter lies in errors in the certificate validation process, which allows attackers to compromise the integrity of the protected information.

The vulnerability of the Python programming language’s cryptography interpreter is related to errors in the certificate authentication process. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

The vulnerability of the StorageAccessAPI component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to compromise data integrity.

The vulnerability of the StorageAccessAPI component in Google Chrome and Microsoft Edge is related to authentication errors. Exploiting this vulnerability can allow an attacker to manipulate data integrity through a specially created HTML page...

The vulnerability of the Content Credentials SDK libraries, related to errors in the certificate authentication process, allows attackers to circumvent existing security restrictions.

The vulnerability of the Content Credentials SDK libraries is related to errors in the certificate authentication process. Exploiting this vulnerability could allow attackers to circumvent existing security restrictions...

CVE-2025-71404

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2025-71404 better-auth before 1.1.16 Reflected XSS via error parameter

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2026-47300

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

ASP.NET Core Elevation of Privilege Vulnerability

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

CVE-2026-8458

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When...

CVE-2026-14340

GitHub Enterprise Server (GitHub ES) suffers an incorrect authorization vulnerability (CVE-2026-14340) where a user-to-server token scoped to a GitHub App installation could perform write operations on public repositories outside the token’s scope. The root cause is an authorization check that on...

USN-8487-1: curl vulnerabilities

Andrew Nesbitt discovered that curl could reuse an existing live connection during STARTTLS-based connection upgrades even when the TLS configuration did not match. A remote attacker could possibly use this issue to cause curl to use an unintended TLS configuration. CVE-2026-8286 Muhamad Arga...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: libceph: The monhandleauthdone function should return the error message. Currently, any error from cephauthhandlereplydone is propagated via finishauth, but it is not returned from monhandleauthdone. This results in higher-level...

The vulnerability of the Microsoft PowerToys system utilities, related to authentication errors, allows a perpetrator to escalate their privileges.

The vulnerability of the Microsoft PowerToys system utilities is related to authentication errors. Exploiting this vulnerability can allow an attacker to gain increased privileges...

The vulnerability of the Adobe Campaign Classic software platform, related to authentication errors, allows a perpetrator to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for managing marketing campaigns is related to authentication errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

CVE-2026-40997

Several Spring WS integration paths with Spring Security could surface detailed account state for example locked or disabled user semantics to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote...

ROS-20260605-73-0034

The vulnerability in Tomcat is related to errors in the implementation of authentication procedures. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

Exploit for SQL Injection in Litellm

CVE-2026-42208 — LiteLLM Pre-Authentication SQL Injection A l...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to authentication errors, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to authentication errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

free5GC 代码问题漏洞

free5GC is an open-source project for the 5th generation 5G mobile core network. Versions of free5GC prior to 4.2.2 contained code vulnerabilities. These vulnerabilities stemmed from the UDR DELETE handler’s type assertion panic when the ueId was not present, which could potentially result in a 5...