210871 matches found
CVE-2026-57195: asterisk: Asterisk is an open source private branch exchange and telephony toolkit
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface AMI may allow an unauthenticated attacker to crash Asterisk wh...
Improper Asterisk exception handling vulnerability
Versions prior to Asterisk 20.20.1, from 21.0.0-pre1 up to versions prior to 21.12.3, from 22.0.0-pre1 up to versions prior to 22.10.1, and from 23.0.0-pre1 up to versions prior to 23.4.1 are affected by an improper exception handling vulnerability. This vulnerability stems from a null pointer...
Hitachi Energy RTU500 Missing Authentication for Critical Function (CVE-2026-8065)
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integri...
UBUNTU-CVE-2026-115910
Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in socialcore/backends/openidconnect.py uses getandstorenonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and getnonce and validateclaims verify only that...
PT-2026-126646
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is...
PT-2026-127255
A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...
VulnCheck KEV: CVE-2026-114509
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowin...
Important: java-25-openjdk security update
The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fixes: JDK: Enhance PKCS5 padding CVE-2026-83374 JDK: Enhance TLS certificate handling CVE-2026-83376 JDK: Improve C2 loop transformations CVE-2026-83378 JDK: Enhance...
Kestra 1.3.20 Authentication Bypass / Remote Code Execution
Kestra version 1.3.20 contains an authentication-filter bypass that permits unauthenticated workflow creation and execution through a path ending in /configs, resulting in command execution inside the worker container. https://packetstorm.news/download/237872...
Asterisk buffer error vulnerability
Versions prior to Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk versions prior to 20.7-cert11 and 22.8-cert3 contain a buffer error vulnerability. This vulnerability arises because the Codec2 decoder fails to handle floor/ceil sample counts correctly, leading to...
PT-2026-126638
An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to...
PT-2026-127213
Name of the Vulnerable Software and Affected Versions Model Context Protocol Python SDK versions 1.10.0 through 1.29.1 Model Context Protocol Python SDK versions 2.0.0 through 2.1.1 Description Server-side bearer authentication configured through AuthSettings with token verifier fails to...
PT-2026-127217
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...
PT-2026-126664
A critical vulnerability in the GoAhead embedded web server causes revoked client certificates to remain valid on certain mutual TLS deployments. Tracked as CVE-2026-115881, the flaw carries a CVSS score of 9.1 and affects GoAhead versions 3.4.5 through 6.1.0. ⠀ GoAhead loads the configured...
Apache Dubbo Admin 0.6.0 Hardcoded Default JWT Secret Authentication Bypass
Summary Apache Dubbo is an RPC service development framework designed to address service governance and communication issues in microservice architectures. The official implementation provides multi-language SDKs such as Java and Golang. Microservices developed using Dubbo inherently possess the...
PT-2026-126408
Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e...
PT-2026-126318
Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 932: from 09-02...
PT-2026-126628
A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic...
PT-2026-126317
Missing Authentication for Critical Function Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 932:...
