CVE-2026-72586 frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

CVE-2026-72584 fastschema - TOCTOU Race Condition Bypasses OTP Attempt Limit in Account Recovery

A time-of-check/time-of-use TOCTOU race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes...

CVE-2026-72584

A time-of-check/time-of-use TOCTOU race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes...

CVE-2026-72575

CVE-2026-72575 affects daptin v0.12.34. An improper authorization flaw in server/permission/permission.go lets unauthenticated guests with a null UserId perform read, create, update, and delete operations on all usergroup records due to permission checks returning true when p.UserId equals the re...

CVE-2026-72575 daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer in server/permission/permission.go return tr...

CVE-2026-72564

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...

WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability

Account Takeover vulnerability discovered by Denver Jackson in WordPress Theme Cartify versions = 1.3.0.1...

CVE-2026-18786

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

CVE-2026-18786 CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

CVE-2026-18786

CVE-2026-18786 affects the CheckView WordPress plugin (versions before 2.3.2). The underlying issue is that the REST API authentication filter is not restricted to the plugin’s own routes and discards the authentication error for any request whose URI contains a plugin-specific string. This allow...

EUVD-2026-55022

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch

A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS Transport Layer Security hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security...

PT-2026-69953

Name of the Vulnerable Software and Affected Versions TrustyAI Service affected versions not specified Description A flaw in the TrustyAI Service TAS deployment allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. This could enable an attacker to...

PT-2026-69989

Name of the Vulnerable Software and Affected Versions PingFederate versions prior to 13.1 Description Cross-Site Request Forgery CSRF weaknesses in the Administrative Console may allow actors to perform unauthorized actions. This occurs when administrators with active sessions are triggered to...

PT-2026-69991

Name of the Vulnerable Software and Affected Versions TP-Link Aginet affected versions not specified Description TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. This issue results from improper...

CVE-2026-16742

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user...

The vulnerability of system calls unlinkat and funlinkat in the kernels of FreeBSD allows a attacker to compromise the integrity of the protected information.

The vulnerability of the unlinkat and funlinkat system calls in FreeBSD operating systems is related to authentication errors. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...

The vulnerability of the Web Speech component in the Firefox web browser and the Thunderbird email client allows attackers to compromise data integrity.

The vulnerability of the Web Speech component in the Firefox web browser and the Thunderbird email client involves bypassing authentication through spoofing. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

The vulnerability of the Cookies component in the Firefox web browser and the Thunderbird email client allows a hacker to trigger a service failure.

The vulnerability of the Cookies component in the Firefox web browser and the Thunderbird email client relates to bypassing authentication by using an alternative path or channel. Exploiting this vulnerability can allow a remote attacker to cause a service failure...