EUVD-2025-210623

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...

Tattile Camera < 1.181.5 - Default Login

Tattile Smart+, Vega, and Basic device families firmware = 1.181.5 contain a broken authentication caused by default credentials not forced to be changed, letting attackers with management interface access gain administrative privileges. id: CVE-2026-26341 info: name: Tattile Camera 1.181.5 -...

EUVD-2026-39022

Ghost: Member existence leak via magic link sign-in response...

EUVD-2026-52856

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

CVE-2026-18759

CVE-2026-18759 affects ASUSTOR Backup Plan (ABP) and ASUSTOR EZ Sync (AES): a file-based IPC protected by AES can be abused by a local authenticated user to recover the IPC key (readable by standard users, DPAPI-protected) and forge IPC requests. Combined with an insufficient substring check for ...

The vulnerability of the Portainer container management platform, related to the improper implementation of authentication algorithms, allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the Portainer container management platform is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability allows an attacker to bypass security restrictions and gain unauthorized access to protected information...

SUSE CVE-2026-55435

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, AI Bridge proxy endpoints authenticate via Server.IsAuthorized in coderd/aibridgedserver, which validates key format, expiry, secret...

CVE-2026-54635

CVE-2026-54635 affects pytonapi 2.0.0–2.2.0, where TonapiWebhookDispatcher fails to validate the Authorization header for webhook handlers registered with a documented path (custom path). The setup() logic only stores bearer tokens for default suffix paths, so self._tokens.get(path) returns None ...

CVE-2026-4648

CVE-2026-4648 concerns CasfID Servicios Tecnológicos S.L.U. NFC wristbands used at Resurrection Fest 2025, which rely on MIFARE Classic (FM11RF08S). The underlying issue is an insecure cryptographic algorithm in the authentication process, enabling an attacker to retrieve access keys via Backdoor...

CVE-2026-59546

Subscriber Broken Authentication in Hide My WP Ghost = 7.0.06 versions...

BIT-DOTNET-SDK-2026-47300 ASP.NET Core Elevation of Privilege Vulnerability

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

BIT-DOTNET-2026-47300 ASP.NET Core Elevation of Privilege Vulnerability

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

PT-2026-65018

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

PT-2026-64992

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function build handoff toolset of the file AstrBot/astrbot/core/astr agent tool exec.py of the component Subagent. The manipulation results in incorrect authorization. The attack may be...

Linux Distros Unpatched Vulnerability : CVE-2026-64389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2...

CVE-2026-61884

The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid...

CVE-2026-12981

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts...

PT-2026-64298

Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.17 Loytec L-INX versions prior to 8.4.17 Loytec L-GATE versions prior to 8.4.17 Loytec L-ROC versions prior to 8.4.17 Loytec L-IOB versions prior to 8.4.17 Loytec L-DALI versions prior to 8.4.17 Loytec...

ROS-20260724-73-0020

The vulnerability in dotnet10.0 is related to the incorrect implementation of the authentication algorithm. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information...

Duplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q5xf-xhwf-cwqf. This link is maintained to preserve external references. Original Description n8n before 2.29.8 and 2.30.x before 2.30.1 affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow w...