PT-2026-123335

Name of the Vulnerable Software and Affected Versions danmu api versions prior to 1.21.7 Description An authentication bypass occurs when the default TOKEN is used and the ADMIN TOKEN is unset. This allows unauthenticated attackers to modify server environment configurations by sending POST...

PT-2026-123215

Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view...

Fortinet FortiSandbox: CVE-2026-107656: Improper access control and session management in the web management interface

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions ma...

PT-2026-123401

Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP processing...

PT-2026-125536

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has be...

Web Authentication Component Compromise

The vulnerability in the Web Authentication component of Google Chrome and Microsoft Edge is related to improper authorization. Exploitation of this vulnerability may allow a remote attacker to compromise the integrity of protected information...

PT-2026-125899

Name of the Vulnerable Software and Affected Versions Qode Membership versions prior to 2.0.6.3 Description An authentication bypass exists that allows for account takeover via the qode membership check facebook user AJAX action. The issue stems from a typographic error in the qode membership log...

PT-2026-123437

A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor w...

ROS-20261026-73-0027

The vulnerability in openssh is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

PT-2026-125522

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data,...

Fortinet FortiSandbox authorization issue vulnerability

Versions 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and all versions 4.2 of Fortinet FortiSandbox are affected by an authorization issue vulnerability. This vulnerability arises from the use of alternative paths or channels, leading to authentication bypass. It may allow attackers to execute...

ROS-20261026-73-0154

The vulnerability in openssh is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

PT-2026-125404

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. A malicious app may be able to access Bluetooth without user consent...

ROS-20261026-73-0143

The vulnerability in openssh is related to insufficient authentication checks. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary code...

RHEL 10 : httpd (RHSA-2026:89860)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89860 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP...

Oracle Linux 10 : httpd (ELSA-2026-89860)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89860 advisory. - Related: RHEL-275253 - httpd: Arbitrary code execution via oversized Host header in modvhostalias CVE-2026-63292 - Resolves: RHEL-280355 - httpd:...

ROS-20261026-73-0159

The OpenSSH software mechanism for managing VMware vCenter Server’s virtual infrastructure contains a vulnerability that can lead to service interruptions during authentication processes. A service interruption occurs when the values of logingraceTime and maxStartup differ from the default values...

PT-2026-123156

A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely...

PT-2026-123194

A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the component Local HTTP Service. The manipulation results in missing authentication. The attack is only possible with local...

PT-2026-125110

Name of the Vulnerable Software and Affected Versions jose versions 1.2.0 through 1.11.12 Description The pure-Erlang AES-GCM fallback in jose jwa aes derives the number of verified authentication tag bits from the attacker-supplied tag. In the aes gcm, Bits clause of the block decrypt/4 function...