Veeam ONE < 13.1.0.7940 (kb4951)

The version of Veeam ONE installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the kb4951 advisory. - A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it...

PT-2026-127758

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server its audience. Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I...

SourceCodester Online Food Ordering System authorization issue vulnerability

The SourceCodester Online Food Ordering System version 1.0 contains an authorization issue vulnerability. This vulnerability stems from improper handling of the ID parameter in the admin/deleteadmin.php file, resulting in a lack of authentication...

Improper Asterisk exception handling vulnerability

Versions prior to Asterisk 20.20.1, from 21.0.0-pre1 up to versions prior to 21.12.3, from 22.0.0-pre1 up to versions prior to 22.10.1, and from 23.0.0-pre1 up to versions prior to 23.4.1 are affected by an improper exception handling vulnerability. This vulnerability stems from a null pointer...

REDAXO CMS core authorization issue vulnerability

REDAXO CMS core versions 5.3.0 through 5.21.4 contain an authorization issue vulnerability. This vulnerability stems from an authentication bypass in the structure/history plugin. Unauthenticated attackers can force the session-bound keys into a predictable state and forge temporary login tokens,...

ROS-20261027-73-0070

The vulnerability in tomcat10 is related to flaws in the authentication process. Exploiting this vulnerability could allow a remote attacker to escalate their privileges...

UBUNTU-CVE-2026-115906

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...

CVE-2026-82332: Improper Authentication

An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to...

Veeam Backup for Microsoft 365 encryption issue vulnerability

Veeam Backup for Microsoft 365 versions 8.0 through 8.6.0.1102 contain an encryption-related vulnerability. This vulnerability allows unauthenticated attackers to exploit forged joint tokens to bypass REST API authentication, potentially preventing them from ever retrieving responses from the RES...

Keepnet Labs Cybersecurity Agentic AI / Agentic Ally authorization issue vulnerability

Versions of Keepnet Labs Cybersecurity Agentic AI / Agentic Ally prior to 0ef61f2e contain an authorization issue vulnerability. This vulnerability stems from authentication bypass caused by deception and may lead to unauthorized authentication...

CVE-2026-106078: Improper Verification of Cryptographic Signature

A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service...

Mozilla Thunderbird security vulnerabilities

A security vulnerability exists in Mozilla Thunderbird versions prior to 159 and prior to Thunderbird 153.6. It arises because the check for mailbox: URL access to a remote Windows network share can be bypassed via an extended length UNC path. This may lead to connection to a SMB server chosen by...

Asterisk buffer error vulnerability

Versions prior to Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk versions prior to 20.7-cert11 and 22.8-cert3 contain a buffer error vulnerability. This vulnerability arises because the Codec2 decoder fails to handle floor/ceil sample counts correctly, leading to...

PT-2026-126412

Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response mode=form post to capture...

Alexandre Espinosa Menor Two-factor verification authorization issue vulnerability

The Alexandre Espinosa Menor two-factor authentication system contains an authorization issue vulnerability. This vulnerability arises from the failure to validate the Client-IP and X-Forwarded-For headers. Once attackers obtain a user’s password, they can forge a whitelist of IP addresses, there...

CVE-2026-57195: asterisk: Asterisk is an open source private branch exchange and telephony toolkit

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface AMI may allow an unauthenticated attacker to crash Asterisk wh...

PT-2026-127217

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

CVE-2026-107671: Authentication Bypass Using an Alternate Path or Channel

A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification...

UBUNTU-CVE-2026-115910

Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in socialcore/backends/openidconnect.py uses getandstorenonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and getnonce and validateclaims verify only that...

bqy_fe nest-admin encryption issue vulnerability

Versions of bqyfe nest-admin prior to 1.0.1 contain an encryption vulnerability. This vulnerability arises from the hard-coded JWTSECRET being submitted to .env.production, resulting in authentication bypass. Unauthenticated attackers can exploit this known key to forge tokens trusted by...