Mozilla Thunderbird security vulnerabilities

A security vulnerability exists in Mozilla Thunderbird versions prior to 159 and prior to Thunderbird 153.6. It arises because the check for mailbox: URL access to a remote Windows network share can be bypassed via an extended length UNC path. This may lead to connection to a SMB server chosen by...

CVE-2026-112710: Heap-based Buffer Overflow

A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially craft...

PT-2026-127147

An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effecti...

@fastify/session race condition vulnerability

A security vulnerability exists in @fastify/session versions prior to 11.1.6. Under the default behavior of rolling sessions, sessions that are restored prior to logout can be re-saved after session termination, allowing them to re-establish their identifiers and authentication data. Attackers...

@fastify/express processing logic error vulnerability

In versions 4.0.5 through 4.0.8 of @fastify/express, there is a logic error vulnerability. This arises when the non-default “ignoreDuplicateSlashes” option is enabled; repeated slashes are normalized, leading to inconsistent path resolution by Express middleware and the Fastify router for...

Hitachi JP1/Automatic Job Management System 3 authorization issue vulnerability

The Hitachi JP1/Automatic Job Management System versions 3 10-00 through 13-50-31 contain an authorization issue vulnerability. This vulnerability stems from improper authentication mechanisms and may allow attackers to bypass authentication...

PLANET WGS-804HPT and WGS-4215 Missing Authentication for Critical Function (CVE-2025-46275)

PLANET WGS-804HPT V2 and WGS-4215-8P2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

PT-2026-126641

A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request...

PT-2026-126406

Name of the Vulnerable Software and Affected Versions NVIDIA NeMo Agent Toolkit versions 1.0 through 1.8.0 Description A missing authentication flaw allows an attacker to bypass security checks. This issue may lead to remote code execution, escalation of privileges, data tampering, denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-115910

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in socialcore/backends/openidconnect.py uses...

PT-2026-126631

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted...

PT-2026-127148

An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionalit...

CVE-2026-87897: Server-Side Request Forgery (SSRF)

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a...

PT-2026-126315

Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31...

CVE-2026-115413: Origin Validation Error

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate th...

Hitachi HiRDB authorization issue vulnerability

Versions 10-00 through 10-12-01 of Hitachi HiRDB, versions 9-00 through 09-66-22 and earlier of HiRDB Server, versions 9-00 through 09-66/V and earlier of HiRDB Server with Additional Function, versions 9-02 through 09-66-22 and earlier of HiRDB Server Version 9 32, and versions 9-00 through...

PT-2026-127205

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159 Description On Windows, a check designed to prevent mailbox: URLs from accessing files on remote network shares can be bypassed using extended-length UNC paths. This allows ...

CVE-2026-90465: Authentication Bypass by Spoofing

A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request...

Apache Dubbo Admin 0.6.0 Hardcoded Default JWT Secret Authentication Bypass

Summary Apache Dubbo is an RPC service development framework designed to address service governance and communication issues in microservice architectures. The official implementation provides multi-language SDKs such as Java and Golang. Microservices developed using Dubbo inherently possess the...

CVE-2026-104189: Missing Authentication for Critical Function

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...