crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

Exploit for Improper Authentication in Hikvision Ds-2Cd2032-I_Firmware

CVE-2017-7921 — Hikvision IP Camera / DVR / NVR Improper Au...

Microsoft Exchange - Authentication Bypass

Microsoft Exchange Server Information Disclosure Vulnerability. This vulnerability enables an attacker to bypass authentication and gain access to the Exchange Server's internal. id: CVE-2021-33766 info: name: Microsoft Exchange - Authentication Bypass author: daffainfo severity: high description...

CLEANSTART-2026-JX43072 max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity

Security vulnerability affects the wildfly package. The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity...

CLEANSTART-2026-WG84677 Improper authentication in ASP

Security vulnerability affects the azure-functions-host package. Improper authentication in ASP...

CLEANSTART-2026-OJ95244 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...

CLEANSTART-2026-GQ21179 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes

Security vulnerability affects the trino package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...

EUVD-2026-110524

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data,...

EUVD-2026-110538

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/deleteadmin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has bee...

EUVD-2026-110495

Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMYSECRET fallback key. When KENERSECRETKEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to...

CVE-2026-116817

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data,...

CVE-2026-116604

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/deleteadmin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has bee...

CVE-2026-115748

A flaw was found in Apache Vysper. Its implementation of Extensible Messaging and Presence Protocol XMPP In-Band Registration lacks an authentication check. An authenticated remote attacker can exploit this vulnerability to compromise other user accounts on the server. Mitigation --- CME...

PT-2026-126642

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request...

PT-2026-126655

A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service...

WatchGuard Fireware OS buffer error vulnerability

Buffer error vulnerabilities exist in WatchGuard Fireware OS versions from 2025.1 up to and including 2026.4, as well as versions from 12.0 up to and including 12.12.4 and from 12.0 up to and including 12.5.22. These vulnerabilities stem from a heap buffer overflow in the authentication service...

PT-2026-126632

A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially craft...

PT-2026-126656

A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification...

Apache Dubbo Admin 0.6.0 Hardcoded JWT Secret Authentication Bypass

Apache Dubbo Admin version 0.6.0 contains a public hardcoded default JWT signing secret that allows remote unauthenticated attackers to forge root session tokens and bypass authentication when the default secret remains configured. Apache Dubbo Admin 0.6.0 Hardcoded Default JWT Secret...

WatchGuard Fireware OS input validation error vulnerability

Security vulnerabilities exist in WatchGuard Fireware OS versions from 12.0 up to and including 12.12.4, as well as versions from 2025.1 up to and including 2026.4. These vulnerabilities stem from XPath injection during SSH authentication. Remote unauthenticated attackers capable of accessing the...