PT-2026-127147

An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effecti...

PT-2026-126406

Name of the Vulnerable Software and Affected Versions NVIDIA NeMo Agent Toolkit versions 1.0 through 1.8.0 Description A missing authentication flaw allows an attacker to bypass security checks. This issue may lead to remote code execution, escalation of privileges, data tampering, denial of...

Kestra 1.3.20 Authentication Bypass / Remote Code Execution

Kestra version 1.3.20 contains an authentication-filter bypass that permits unauthenticated workflow creation and execution through a path ending in /configs, resulting in command execution inside the worker container. https://packetstorm.news/download/237872...

PT-2026-127205

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159 Description On Windows, a check designed to prevent mailbox: URLs from accessing files on remote network shares can be bypassed using extended-length UNC paths. This allows ...

Laravel Framework 13.28.0 TokenGuard Authentication Bypass

Laravel Framework versions prior to 12.68.0 and 13.29.0 contain an authentication bypass in TokenGuard when non-string API credentials are processed with MySQL or MariaDB. The supplied proof of concept scans for affected targets and attempts authentication bypasses...

PT-2026-126423

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust,...

Asterisk buffer error vulnerability

Versions prior to Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk versions prior to 20.7-cert11 and 22.8-cert3 contain a buffer error vulnerability. This vulnerability arises because the Codec2 decoder fails to handle floor/ceil sample counts correctly, leading to...

Alexandre Espinosa Menor Two-factor verification authorization issue vulnerability

The Alexandre Espinosa Menor two-factor authentication system contains an authorization issue vulnerability. This vulnerability arises from the failure to validate the Client-IP and X-Forwarded-For headers. Once attackers obtain a user’s password, they can forge a whitelist of IP addresses, there...

CVE-2026-57195: asterisk: Asterisk is an open source private branch exchange and telephony toolkit

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface AMI may allow an unauthenticated attacker to crash Asterisk wh...

CVE-2026-118176: Undefined Security Weakness

Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows...

PT-2026-126655

A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service...

PT-2026-126632

A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially craft...

PT-2026-127148

An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionalit...

PT-2026-126641

A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request...

Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1

Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program VDP for all Veeam products and perform extensive internal code audits. When a vulnerability is...

PT-2026-126631

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted...

PT-2026-126624

Improper authentication in the inter-process communication IPC mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary co...

PT-2026-126663

Name of the Vulnerable Software and Affected Versions GoAhead versions 3.4.5 through 6.1.0 Description GoAhead is a small web server used in routers, printers, and industrial controllers. A flaw exists where the server loads the Certificate Revocation List CRL but fails to apply it. This allows...

Improper Asterisk exception handling vulnerability

Versions prior to Asterisk 20.20.1, from 21.0.0-pre1 up to versions prior to 21.12.3, from 22.0.0-pre1 up to versions prior to 22.10.1, and from 23.0.0-pre1 up to versions prior to 23.4.1 are affected by an improper exception handling vulnerability. This vulnerability stems from a null pointer...

Linux Distros Unpatched Vulnerability : CVE-2026-116193

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by...