PT-2026-81270

Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges...

PT-2026-81255

Name of the Vulnerable Software and Affected Versions Apache Hive versions 4.0.0 through 4.2.0 Description Improper authentication occurs during SAML bearer-token validation in HiveServer2 on deployments using HTTP transport with hive.server2.authentication=SAML. An unauthenticated network attack...

PT-2026-81257

Name of the Vulnerable Software and Affected Versions LACT versions prior to 0.10.1 Description An authentication bypass exists in LACT on Linux due to the way Polkit authentication is handled based on UnixProcessSubject and Peer PID. This allows an attacker to circumvent the required...

PT-2026-81482

Name of the Vulnerable Software and Affected Versions Alluxio affected versions not specified Description The S3 REST proxy fails to verify AWS Signature Version 4 signatures when using the default configuration. This allows unauthenticated attackers to spoof user identity by extracting usernames...

The vulnerability of the Loopback microprogramming system authentication mechanism in Dahua devices allows attackers to escalate their privileges.

The vulnerability of the Loopback microprogramming system authentication mechanism of Dahua devices is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers, operating remotely, to enhance their privileges...

PT-2026-81884

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.30 through 7.0.109...

PT-2026-81887

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109...

CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

!/usr/bin/env python3 """ CVE-2026-42167 — ProFTPD modsql post-authentication SQL injection - RCE postauthstorrce.py --host --port 21 \ --user --password \ --shell-host --shell-port 4444 SUMMARY ------- ProFTPD's modsql logs FTP activity through user-supplied SQL. Its escaping helper isescapedtex...

Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)

The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.14.6. It is, therefore, affected by a log injection vulnerability: - The Basic authentication username is decoded before credential validation and passed to the access logger without neutralizing control characters. A...

PT-2026-81913

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.53.0 Description An open redirect issue exists in the SAML authentication success handler. The system accepts unvalidated RelayState POST parameters as redirect destinations, allowing attackers with Identity Provider...

CVE-2026-75465

The /api.php/user/get_list endpoint in Maccms v10 (version v2026.1000.4055) suffers from an Incorrect Access Control flaw: it performs no authentication or authorization checks. An unauthenticated remote attacker can issue a crafted HTTP GET request using limit and offset parameters to paginate t...

PT-2026-81126

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

PT-2026-81888

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109...

PT-2026-81514

Name of the Vulnerable Software and Affected Versions NVIDIA NemoClaw for Linux affected versions not specified Description A flaw in the remote-access helper workflow allows for weak authentication. This issue could enable an attacker to achieve remote code execution, disclose sensitive...

PT-2026-81202

Name of the Vulnerable Software and Affected Versions ash authentication versions 3.10.5 through 4.14.1 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.12 Description Improper authentication allows purpose-limited JSON Web Tokens JWTs to be replayed as full bearer API credentials when a...

The vulnerability of the matchSession() function in the fs/smb/client/connect.c module of the Smb file system in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the matchSession function in the fs/smb/client/connect.c file of the SMB file system module in the Linux operating system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

PT-2026-81738

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Incorrect authorization in Web Authentication Passkeys & Security Keys allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a...

Oracle Linux 9 : grafana (ELSA-2026-58982)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-58982 advisory. - Resolves RHEL-183803: CVE-2026-39821 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note th...

Linux Distros Unpatched Vulnerability : CVE-2026-77337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through...

PT-2026-81909

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...