PT-2026-126664

I just read about this one. CVE-2026-115881 and CVE-2026-115884: including issues with lack of revocation checking, mTLS validation bypass and a trivial DHE private value usage this last one doesn’t have a CVE for some reason...

ROS-20261027-73-0069

A vulnerability in Tomcat related to flaws in the authentication process. Exploiting this vulnerability could allow a remote attacker to escalate their privileges...

Hitachi Energy RTU500 Missing Authentication for Critical Function (CVE-2026-8065)

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integri...

Veeam ONE < 13.1.0.7940 (kb4951)

The version of Veeam ONE installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the kb4951 advisory. - A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it...

CVE-2026-112709: Heap-based Buffer Overflow

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted...

CVE-2026-93434: Improper Input Validation

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request...

CVE-2026-104381: Authentication Bypass by Capture-replay

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic...

VulnCheck KEV: CVE-2026-114509

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowin...

CVE-2026-92376: Improper Authentication

Improper authentication in the inter-process communication IPC mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary co...

Laravel Framework 13.28.0 TokenGuard Authentication Bypass

Laravel Framework versions prior to 12.68.0 and 13.29.0 contain an authentication bypass in TokenGuard when non-string API credentials are processed with MySQL or MariaDB. The supplied proof of concept scans for affected targets and attempts authentication bypasses...

PT-2026-126656

A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification...

PT-2026-126655

A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service...

Linux Distros Unpatched Vulnerability : CVE-2026-116193

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by...

PT-2026-126408

Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e...

WatchGuard Fireware OS authorization issue vulnerability

Security vulnerabilities exist in WatchGuard Fireware OS versions from 2025.1 up to and including 2026.4, from version 12.0 up to and including 12.12.4, and from version 12.0 up to and including 12.5.22. These vulnerabilities stem from a lack of authentication during FireCluster Sync processing,...

SourceCodester Online Food Ordering System authorization issue vulnerability

The SourceCodester Online Food Ordering System version 1.0 contains an authorization issue vulnerability. This vulnerability stems from improper handling of the ID parameter in the admin/deleteadmin.php file, resulting in a lack of authentication...

PT-2026-127213

Name of the Vulnerable Software and Affected Versions Model Context Protocol Python SDK versions 1.10.0 through 1.29.1 Model Context Protocol Python SDK versions 2.0.0 through 2.1.1 Description Server-side bearer authentication configured through AuthSettings with token verifier fails to...

Model Context Protocol MCP Python SDK authorization issue vulnerability

Versions 1.10.0 through 1.30.0 and 2.0.0 through 2.2.0 of the Model Context Protocol MCP Python SDK contain an authorization issue vulnerability. This vulnerability arises because server-side Bearer authentication configured via the tokenverifier parameter in AuthSettings accepts valid tokens...

PT-2026-126367

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

CVE-2026-112352: Reliance on Cookies without Validation and Integrity Checking

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...