211640 matches found
CVE-2026-101272: pretix: The mechanism binding files generated during a shredding process to the authentication method is not working correctly…
The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referre...
CVE-2026-103409: Juniper Networks Session Smart Router: A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an…
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can on...
PT-2026-128344
Name of the Vulnerable Software and Affected Versions russh versions 0.50.0-beta.12 through 0.64.0 Description The agent server's Connection::try sign path in russh/src/keys/agent/server.rs recognizes SSH AGENT CONSTRAIN CONFIRM but returns a hard-coded successful result instead of calling...
PT-2026-129186
Name of the Vulnerable Software and Affected Versions @graphql-tools/executor-legacy-ws versions prior to 1.1.36 Description In the buildWSLegacyExecutor function within packages/executors/legacy-ws/src/index.ts, the executorConnectionParams object is retained in the closure scope after a...
PT-2026-128224
Name of the Vulnerable Software and Affected Versions Waline versions prior to 1.41.1 Description The login endpoint 'POST /api/token' reads the email field from the request body without type validation and passes it directly into a MongoDB storage query. If the email field is provided as a...
Jenkins security vulnerabilities
Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities arise because requests using HTTP Basic authentication—including those containing an API token—can result in the acquisition of a “remember me” cookie. As a consequence,...
PT-2026-128289
A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...
Oracle Application Object Library Code Execution
The vulnerability in the Core component of the Oracle Application Object Library for Oracle E-Business Suite enterprise activity automation is related to flaws in the authentication process. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code and gain full contr...
CVE-2026-110952: Insufficient Verification of Data Authenticity
A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...
CVE-2026-109236: zorem Customer Email Verification for WooCommerce: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a…
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...
WSO2 API Manager session mechanism vulnerability
Versions 3.1.0 through 3.1.0.367, 3.2.0 through 3.2.0.475, 3.2.1 through 3.2.1.106, 4.0.0 through 4.0.0.394, 4.1.0 through 4.1.0.267, 4.2.0 through 4.2.0.207, 4.3.0 through 4.3.0.120, 4.4.0 through 4.4.0.83, 4.5.0 through 4.5.0.67, 4.6.0 through 4.6.0.29, and 4.7.0 through 4.7.0.3 contain a sessi...
VulnCheck KEV: CVE-2026-86426
LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...
VulnCheck KEV: CVE-2026-76418
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service DoS condition...
Linux Distros Unpatched Vulnerability : CVE-2026-118176
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths...
Linux Distros Unpatched Vulnerability : CVE-2026-107147
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The twofactorgauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of...
Rocky Linux 10.2 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_89860)
The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689860 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via intege...
CVE-2026-24061
-c0392b?style=flat GNU InetUtils telnetd - Unauthenticated Remote Root via NEW-ENVIRON Variable Injection Overview - Technical Analysis - Affected Versions - Usage - Remediation - References Vulnerability Overview CVE-2026-24061 is a critical authentication bypass vulnerability in the telnetd...
CVE-2026-118129
A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...
CVE-2026-118129 jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication
A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...
CVE-2026-118129
A vulnerability exists in jeremyckahn Chitchatter (up to commit f82538633813c854a81a8b2112a2f6ba17b39cbc ) within the PostMessage Handler component. The isConfigMessageEvent function in the src/Bootstrap.tsx file is susceptible to improper authentication due to the manipulation of the parentDomai...