CVE-2026-104384: EagleCloud Aquila: Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions…

Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access the access keys, secret keys, and deployment...

PT-2026-128344

Name of the Vulnerable Software and Affected Versions russh versions 0.50.0-beta.12 through 0.64.0 Description The agent server's Connection::try sign path in russh/src/keys/agent/server.rs recognizes SSH AGENT CONSTRAIN CONFIRM but returns a hard-coded successful result instead of calling...

PT-2026-128056

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing...

PT-2026-128289

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...

CVE-2026-101272: pretix: The mechanism binding files generated during a shredding process to the authentication method is not working correctly…

The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referre...

CVE-2026-110952: Insufficient Verification of Data Authenticity

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...

CVE-2026-109236: zorem Customer Email Verification for WooCommerce: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a…

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...

PT-2026-129181

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall ASA Software affected versions not specified Cisco Secure Firewall FTD Software affected versions not specified Description A flaw exists in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security...

PT-2026-129186

Name of the Vulnerable Software and Affected Versions @graphql-tools/executor-legacy-ws versions prior to 1.1.36 Description In the buildWSLegacyExecutor function within packages/executors/legacy-ws/src/index.ts, the executorConnectionParams object is retained in the closure scope after a...

CVE-2026-103409: Juniper Networks Session Smart Router: A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an…

A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can on...

CVE-2026-76418: Unchecked Return Value to NULL Pointer Dereference

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-107147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The twofactorgauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of...

VulnCheck KEV: CVE-2026-86426

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

VulnCheck KEV: CVE-2026-76418

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service DoS condition...

CVE-2026-118690: SignalK signalk-server: Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote…

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

PT-2026-128061

Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 42569, Acronis Cyber Protect 17 Windows before build 42587...

PT-2026-128224

Name of the Vulnerable Software and Affected Versions Waline versions prior to 1.41.1 Description The login endpoint 'POST /api/token' reads the email field from the request body without type validation and passes it directly into a MongoDB storage query. If the email field is provided as a...

CVE-2025-30414: Acronis: Local privilege escalation due to improper authentication

Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 42569, Acronis Cyber Protect 17 Windows before build 42587...

CVE-2026-103382: Unknown Casso Flow: The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment…

The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid,...

Jenkins security vulnerabilities

Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities arise because requests using HTTP Basic authentication—including those containing an API token—can result in the acquisition of a “remember me” cookie. As a consequence,...