CVE-2026-112352: Reliance on Cookies without Validation and Integrity Checking

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

Sunhillo SureLine session mechanism vulnerability

Versions prior to Sunhillo SureLine 9.1.5 contain a vulnerability related to the session mechanism. This vulnerability stems from authentication bypass; unauthenticated remote attackers can forge session cookies containing only plaintext usernames, lacking random identifiers or integrity checks. ...

PT-2026-126664

I just read about this one. CVE-2026-115881 and CVE-2026-115884: including issues with lack of revocation checking, mTLS validation bypass and a trivial DHE private value usage this last one doesn’t have a CVE for some reason...

PT-2026-126408

Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e...

ROS-20261027-73-0069

A vulnerability in Tomcat related to flaws in the authentication process. Exploiting this vulnerability could allow a remote attacker to escalate their privileges...

Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1

Issue Details CVE-2026-107671 A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification. Severity: High CVSS v4.0 Score: 8.5CVSS: AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:...

Linux Distros Unpatched Vulnerability : CVE-2026-116193

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by...

Hitachi Energy RTU500 Missing Authentication for Critical Function (CVE-2026-8065)

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integri...

CVE-2026-92376: Improper Authentication

Improper authentication in the inter-process communication IPC mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary co...

Apache Dubbo Admin 0.6.0 Hardcoded JWT Secret Authentication Bypass

Apache Dubbo Admin version 0.6.0 contains a public hardcoded default JWT signing secret that allows remote unauthenticated attackers to forge root session tokens and bypass authentication when the default secret remains configured. Apache Dubbo Admin 0.6.0 Hardcoded Default JWT Secret...

CVE-2026-104381: Authentication Bypass by Capture-replay

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic...

WatchGuard Fireware OS authorization issue vulnerability

Security vulnerabilities exist in WatchGuard Fireware OS versions from 2025.1 up to and including 2026.4, as well as versions 12.7 through 12.12.4. These vulnerabilities stem from improper authentication within the AuthPoint multi-factor authentication process. As a result, locally unauthenticate...

VulnCheck KEV: CVE-2026-114509

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowin...

WatchGuard Fireware OS authorization issue vulnerability

Security vulnerabilities exist in WatchGuard Fireware OS versions from 2025.1 up to and including 2026.4, from version 12.0 up to and including 12.12.4, and from version 12.0 up to and including 12.5.22. These vulnerabilities stem from a lack of authentication during FireCluster Sync processing,...

PT-2026-127758

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server its audience. Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I...

SourceCodester Online Food Ordering System authorization issue vulnerability

The SourceCodester Online Food Ordering System version 1.0 contains an authorization issue vulnerability. This vulnerability stems from improper handling of the ID parameter in the admin/deleteadmin.php file, resulting in a lack of authentication...

Kestra 1.3.20 Authentication Bypass / Remote Code Execution

Kestra version 1.3.20 contains an authentication-filter bypass that permits unauthenticated workflow creation and execution through a path ending in /configs, resulting in command execution inside the worker container. https://packetstorm.news/download/237872...

CVE-2026-112709: Heap-based Buffer Overflow

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted...

Laravel Framework 13.28.0 TokenGuard Authentication Bypass

Laravel Framework versions prior to 12.68.0 and 13.29.0 contain an authentication bypass in TokenGuard when non-string API credentials are processed with MySQL or MariaDB. The supplied proof of concept scans for affected targets and attempts authentication bypasses...

PT-2026-127213

Name of the Vulnerable Software and Affected Versions Model Context Protocol Python SDK versions 1.10.0 through 1.29.1 Model Context Protocol Python SDK versions 2.0.0 through 2.1.1 Description Server-side bearer authentication configured through AuthSettings with token verifier fails to...