CVE-2026-73125

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability...

CVE-2026-71187

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...

CVE-2026-39944

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

AZL-98039 CVE-2025-30156 affecting package ceph 18.2.2-12

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...

PT-2026-83066

Name of the Vulnerable Software and Affected Versions Dovecot affected versions not specified Description Information forwarded from a host configured as a trusted proxy is not properly isolated from internal authentication fields. This allows a trusted proxy to inject values into internal...

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

PaperCut NG < 24.1.9.76516 / 25.x < 25.0.12.76510 / 26.x < 26.0.4.76508 Multiple Vulnerabilities

The version of PaperCut NG installed on the remote Windows host is prior to 24.1.9.76516 or 25.x prior to 25.0.12.76510, or 26.x prior to 26.0.4.76508. It is, therefore, affected by the following vulnerabilities: - An authentication bypass vulnerability exists in the web management interface due ...

PT-2026-83370

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 1.4.5 Description The AUSF component uses non-constant-time equality helpers for cryptographic authentication comparisons in internal/sbi/processor/ue authentication.go. Specifically, the...

PT-2026-83316

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.111.21 JFrog Artifactory versions prior to 7.117.28 JFrog Artifactory versions prior to 7.125.20 JFrog Artifactory versions prior to 7.133.29 JFrog Artifactory versions prior to 7.146.38 JFrog Artifactory...

PaperCut MF < 24.1.9.76515 / 25.x < 25.0.12.76509 / 26.x < 26.0.4.76507 Multiple Vulnerabilities

The version of PaperCut MF installed on the remote Windows host is prior to 24.1.9.76515 or 25.x prior to 25.0.12.76509, or 26.x prior to 26.0.4.76507. It is, therefore, affected by the following vulnerabilities: - An authentication bypass vulnerability exists in the web management interface due ...

PT-2026-83300

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

PT-2026-83116

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

PT-2026-83369

Name of the Vulnerable Software and Affected Versions free5GC versions 1.4.4 and earlier Description The AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool within internal/context/context.go, using only the SUPI as a key. Requests processed by...

PT-2026-83348

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions prior to 3.3.3 MariaDB Connector/Node.js versions prior to 3.4.6 MariaDB Connector/Node.js versions prior to 3.5.3 Description MariaDB Connector/Node.js can...

PT-2026-83362

Name of the Vulnerable Software and Affected Versions MongoDB Connector for BI affected versions not specified Description An unauthenticated network-reachable client can cause resource exhaustion by initiating a SASL-based login exchange and failing to complete it. Because the negotiation loop...

PT-2026-83289

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin api require auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...

CVE-2026-73208

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...

PT-2026-83135

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw exists where the source-address critical option in the Permissions returned by certain authentication callbacks is not validated against the client's remo...

PT-2026-83373

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9 Description When using PAM dialog authentication, the connector ca...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21645-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21645-1 advisory. This update for trivy fixes the following issue: - CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing...