PT-2026-126628

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic...

CVE-2026-112710: Heap-based Buffer Overflow

A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially craft...

Cisco Emergency Responder Authentication Bypass

The vulnerability in the Cisco Emergency Responder management and monitoring server, as well as in the Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME call processing systems, is related to flaws in the...

PT-2026-126317

Missing Authentication for Critical Function Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 932:...

PT-2026-126423

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust,...

CVE-2026-118176: Undefined Security Weakness

Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows...

PT-2026-127148

An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionalit...

CVE-2026-87897: Server-Side Request Forgery (SSRF)

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a...

CVE-2026-90465: Authentication Bypass by Spoofing

A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request...

PLANET WGS-804HPT and WGS-4215 Missing Authentication for Critical Function (CVE-2025-46275)

PLANET WGS-804HPT V2 and WGS-4215-8P2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

PT-2026-126641

A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request...

Apache Dubbo Admin 0.6.0 Hardcoded Default JWT Secret Authentication Bypass

Summary Apache Dubbo is an RPC service development framework designed to address service governance and communication issues in microservice architectures. The official implementation provides multi-language SDKs such as Java and Golang. Microservices developed using Dubbo inherently possess the...

Linux Distros Unpatched Vulnerability : CVE-2026-115910

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in socialcore/backends/openidconnect.py uses...

CVE-2026-115413: Origin Validation Error

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate th...

PT-2026-126646

A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is...

PT-2026-127205

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159 Description On Windows, a check designed to prevent mailbox: URLs from accessing files on remote network shares can be bypassed using extended-length UNC paths. This allows ...

PT-2026-126631

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted...

PT-2026-127236

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface AMI may allow an unauthenticated attacker to crash Asterisk wh...

PT-2026-126663

Name of the Vulnerable Software and Affected Versions GoAhead versions 3.4.5 through 6.1.0 Description GoAhead is a small web server used in routers, printers, and industrial controllers. A flaw exists where the server loads the Certificate Revocation List CRL but fails to apply it. This allows...

Flowise Authentication Bypass

In Flowise versions 3.0.1 through 3.0.5, the forgot-password endpoint returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading...