CVE-2026-101272: pretix: The mechanism binding files generated during a shredding process to the authentication method is not working correctly…

The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referre...

PT-2026-128344

Name of the Vulnerable Software and Affected Versions russh versions 0.50.0-beta.12 through 0.64.0 Description The agent server's Connection::try sign path in russh/src/keys/agent/server.rs recognizes SSH AGENT CONSTRAIN CONFIRM but returns a hard-coded successful result instead of calling...

PT-2026-128289

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...

Linux Distros Unpatched Vulnerability : CVE-2026-118176

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths...

CVE-2026-103779: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. A low privilege...

Linux Distros Unpatched Vulnerability : CVE-2026-107147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The twofactorgauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of...

Rocky Linux 10.2 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_89860)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689860 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via intege...

CVE-2026-24061

-c0392b?style=flat GNU InetUtils telnetd - Unauthenticated Remote Root via NEW-ENVIRON Variable Injection Overview - Technical Analysis - Affected Versions - Usage - Remediation - References Vulnerability Overview CVE-2026-24061 is a critical authentication bypass vulnerability in the telnetd...

CVE-2026-118129 jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...

CVE-2026-118129

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...

CVE-2026-118129

A vulnerability exists in jeremyckahn Chitchatter (up to commit f82538633813c854a81a8b2112a2f6ba17b39cbc ) within the PostMessage Handler component. The isConfigMessageEvent function in the src/Bootstrap.tsx file is susceptible to improper authentication due to the manipulation of the parentDomai...

CVE-2026-118129 jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...

CVE-2026-118129 jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...

DEBIAN-CVE-2026-57195

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface AMI may allow an unauthenticated attacker to crash Asterisk wh...

CVE-2026-57195

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface AMI may allow an unauthenticated attacker to crash Asterisk wh...

CVE-2026-57195

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface AMI may allow an unauthenticated attacker to crash Asterisk wh...

CVE-2026-114509

CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials 🔴 CVE-2026-114509 — Laravel TokenGuard Authentication Bypass Unauthenticated Authentication Bypass in Laravel Framework — TokenGuard API Guard 📋 Overview CVE-2026-114509 is a critical authentication bypass...

GHSA-W4FH-QVV9-3V23 Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server its audience. Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I...

Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server its audience. Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I...

CVE-2026-57195

The Asterisk telephony toolkit is vulnerable to a NULL pointer dereference in the Asterisk Manager Interface (AMI) . This flaw allows an unauthenticated attacker to crash the service when Digest Authentication is used via HTTP . To exploit this, the Asterisk HTTP web server, AMI, and AMI access v...