PT-2026-126624

Improper authentication in the inter-process communication IPC mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary co...

PT-2026-126386

Name of the Vulnerable Software and Affected Versions @fastify/express versions 4.0.5 through 4.0.8 Description When the non-default ignoreDuplicateSlashes option is enabled, the plugin matches path-scoped Express middleware against a URL where duplicate-slash normalization collapses the separato...

Hikvision IP Camera Firmware V5.4.5 Improper Authentication

Hikvision IP camera firmware versions through V5.4.5 contain an improper authentication vulnerability that allows unauthenticated attackers to bypass normal access controls and obtain administrative device access...

Developing a Dynamic Multi-Factor Authentication System for Securing Smart Organizations

As smart organizations increasingly rely on technologies like AI, big data, and IoT, securing these systems is crucial. This research introduces a dynamic multi-factor authentication MFA system within the Zero Trust Architecture ZTA framework, which enforces continuous verification. The system...

Hitachi JP1/Automatic Job Management System 3 authorization issue vulnerability

The Hitachi JP1/Automatic Job Management System versions 3 10-00 through 13-50-31 contain an authorization issue vulnerability. This vulnerability stems from improper authentication mechanisms and may allow attackers to bypass authentication...

PT-2026-126423

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust,...

CVE-2026-118176: Undefined Security Weakness

Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows...

PT-2026-126631

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted...

PT-2026-126318

Name of the Vulnerable Software and Affected Versions HiRDB Server versions 10-00 through 10-12-00 HiRDB Server versions 09-00 through 09-66-22 HiRDB Server with Additional Function versions 09-00 through 09-66/V HiRDB Server Version 932 versions 09-02 through 09-66-22 HiRDB Server with Additiona...

PT-2026-127205

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159 Description On Windows, a check designed to prevent mailbox: URLs from accessing files on remote network shares can be bypassed using extended-length UNC paths. This allows ...

PT-2026-127148

An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionalit...

CVE-2026-87897: Server-Side Request Forgery (SSRF)

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a...

PT-2026-126315

Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31...

Hitachi HiRDB authorization issue vulnerability

Versions 10-00 through 10-12-01 of Hitachi HiRDB, versions 9-00 through 09-66-22 and earlier of HiRDB Server, versions 9-00 through 09-66/V and earlier of HiRDB Server with Additional Function, versions 9-02 through 09-66-22 and earlier of HiRDB Server Version 9 32, and versions 9-00 through...

CVE-2026-90465: Authentication Bypass by Spoofing

A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request...

CVE-2026-104189: Missing Authentication for Critical Function

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...

PLANET WGS-804HPT and WGS-4215 Missing Authentication for Critical Function (CVE-2025-46275)

PLANET WGS-804HPT V2 and WGS-4215-8P2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

PT-2026-126641

A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request...

Apache Dubbo Admin 0.6.0 Hardcoded Default JWT Secret Authentication Bypass

Summary Apache Dubbo is an RPC service development framework designed to address service governance and communication issues in microservice architectures. The official implementation provides multi-language SDKs such as Java and Golang. Microservices developed using Dubbo inherently possess the...

Linux Distros Unpatched Vulnerability : CVE-2026-115910

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in socialcore/backends/openidconnect.py uses...