212088 matches found
CVE-2026-86391: Dell PowerProtect Data Domain Management Center: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing...
CVE-2026-104384: EagleCloud Aquila: Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions…
Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access the access keys, secret keys, and deployment...
PT-2026-128056
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing...
CVE-2026-110952: Insufficient Verification of Data Authenticity
A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...
CVE-2026-109236: zorem Customer Email Verification for WooCommerce: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a…
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...
PT-2026-129181
Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall ASA Software affected versions not specified Cisco Secure Firewall FTD Software affected versions not specified Description A flaw exists in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security...
CVE-2026-103409: Juniper Networks Session Smart Router: A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an…
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can on...
CVE-2026-76418: Unchecked Return Value to NULL Pointer Dereference
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service...
VulnCheck KEV: CVE-2026-86426
LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...
Oracle Application Object Library Code Execution
The vulnerability in the Core component of the Oracle Application Object Library for Oracle E-Business Suite enterprise activity automation is related to flaws in the authentication process. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code and gain full contr...
CVE-2026-118690: SignalK signalk-server: Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote…
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...
VulnCheck KEV: CVE-2026-76418
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service DoS condition...
Linux Distros Unpatched Vulnerability : CVE-2026-118176
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths...
PT-2026-128224
Name of the Vulnerable Software and Affected Versions Waline versions prior to 1.41.1 Description The login endpoint 'POST /api/token' reads the email field from the request body without type validation and passes it directly into a MongoDB storage query. If the email field is provided as a...
PT-2026-128344
Name of the Vulnerable Software and Affected Versions russh versions 0.50.0-beta.12 through 0.64.0 Description The agent server's Connection::try sign path in russh/src/keys/agent/server.rs recognizes SSH AGENT CONSTRAIN CONFIRM but returns a hard-coded successful result instead of calling...
PT-2026-128061
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 42569, Acronis Cyber Protect 17 Windows before build 42587...
CVE-2025-30414: Acronis: Local privilege escalation due to improper authentication
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 42569, Acronis Cyber Protect 17 Windows before build 42587...
CVE-2026-103382: Unknown Casso Flow: The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment…
The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid,...
PT-2026-127916
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An...
PT-2026-130623
Name of the Vulnerable Software and Affected Versions Bot for Telegram on WooCommerce versions prior to 1.3.1 Description An authentication bypass exists that allows unauthenticated attackers to take over any account, including administrators, using only a username. The issue occurs because the...