359 matches found
UBUNTU-CVE-2026-115906
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: libceph: The handler error from monhandleauthdone should be returned. Currently, any error from cephauthhandlereplydone is propagated via finishauth, but it is not returned from monhandleauthdone. This results in higher layers...
ROS-20260909-73-0168
The vulnerability of the StorageAccessAPI component in Google Chrome and Microsoft Edge is related to authentication errors. Exploiting this vulnerability can allow an attacker to manipulate data integrity through a specially created HTML page...
Palo Alto Networks GlobalProtect App Certificate Validation Man-in-the-Middle
The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to errors in the authentication process. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...
Python cryptography Certificate Validation
The vulnerability of the Python programming language’s cryptography interpreter is related to errors in the certificate authentication process. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...
Google Chrome Microsoft Edge Data Compromise
The vulnerability in the StorageAccessAPI component of Google Chrome and Microsoft Edge web browsers is related to authorization errors. Exploitation of this vulnerability enables a remote attacker to compromise data integrity by using a specially crafted HTML page...
Content Credentials SDK Certificate Authentication Bypass
The vulnerability of the Content Credentials SDK libraries is related to errors in the certificate authentication process. Exploiting this vulnerability could allow attackers to circumvent existing security restrictions...
CVE-2025-71404
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...
CVE-2025-71404 better-auth before 1.1.16 Reflected XSS via error parameter
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...
NPM: Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
NPM: Auth.js: getToken throws an uncaught exception on malformed Bearer authorization headers vulnerability discovered by ? in WordPress Npm next-auth versions = 4.0.6, = 4.24.14...
CVE-2026-47300
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...
CVE-2026-8458
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When...
CVE-2026-14340
GitHub Enterprise Server (GitHub ES) suffers an incorrect authorization vulnerability (CVE-2026-14340) where a user-to-server token scoped to a GitHub App installation could perform write operations on public repositories outside the token’s scope. The root cause is an authorization check that on...
USN-8487-1: curl vulnerabilities
Andrew Nesbitt discovered that curl could reuse an existing live connection during STARTTLS-based connection upgrades even when the TLS configuration did not match. A remote attacker could possibly use this issue to cause curl to use an unintended TLS configuration. CVE-2026-8286 Muhamad Arga...
Microsoft PowerToys Privilege Escalation
The vulnerability of the Microsoft PowerToys system utilities is related to authentication errors. Exploiting this vulnerability can allow an attacker to gain increased privileges...
Adobe Campaign Classic Auth Bypass RCE
The vulnerability of the Adobe Campaign Classic software platform for managing marketing campaigns is related to authentication errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...
CVE-2026-40997
Several Spring WS integration paths with Spring Security could surface detailed account state for example locked or disabled user semantics to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote...
ROS-20260605-73-0034
The vulnerability in Tomcat is related to errors in the implementation of authentication procedures. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...
