CVE-2026-115413: Origin Validation Error

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate th...

PT-2026-126646

A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is...

PT-2026-127205

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159 Description On Windows, a check designed to prevent mailbox: URLs from accessing files on remote network shares can be bypassed using extended-length UNC paths. This allows ...

PT-2026-126631

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted...

PT-2026-127236

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface AMI may allow an unauthenticated attacker to crash Asterisk wh...

PT-2026-126663

Name of the Vulnerable Software and Affected Versions GoAhead versions 3.4.5 through 6.1.0 Description GoAhead is a small web server used in routers, printers, and industrial controllers. A flaw exists where the server loads the Certificate Revocation List CRL but fails to apply it. This allows...

Flowise Authentication Bypass

In Flowise versions 3.0.1 through 3.0.5, the forgot-password endpoint returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading...

ROS-20261027-73-0071

The vulnerability in tomcat11 is related to flaws in the authentication process. Exploiting this vulnerability could allow a remote attacker to escalate their privileges...

@fastify/session race condition vulnerability

A security vulnerability exists in @fastify/session versions prior to 11.1.6. Under the default behavior of rolling sessions, sessions that are restored prior to logout can be re-saved after session termination, allowing them to re-establish their identifiers and authentication data. Attackers...

PT-2026-126406

Name of the Vulnerable Software and Affected Versions NVIDIA NeMo Agent Toolkit versions 1.0 through 1.8.0 Description A missing authentication flaw allows an attacker to bypass security checks. This issue may lead to remote code execution, escalation of privileges, data tampering, denial of...

WatchGuard Fireware OS buffer error vulnerability

Buffer error vulnerabilities exist in WatchGuard Fireware OS versions from 2025.1 up to and including 2026.4, as well as versions from 12.0 up to and including 12.12.4 and from 12.0 up to and including 12.5.22. These vulnerabilities stem from a heap buffer overflow in the authentication service...

PT-2026-127147

An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effecti...

@fastify/express processing logic error vulnerability

In versions 4.0.5 through 4.0.8 of @fastify/express, there is a logic error vulnerability. This arises when the non-default “ignoreDuplicateSlashes” option is enabled; repeated slashes are normalized, leading to inconsistent path resolution by Express middleware and the Fastify router for...

CVE-2026-104189: Missing Authentication for Critical Function

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...

PT-2026-126318

Name of the Vulnerable Software and Affected Versions HiRDB Server versions 10-00 through 10-12-00 HiRDB Server versions 09-00 through 09-66-22 HiRDB Server with Additional Function versions 09-00 through 09-66/V HiRDB Server Version 932 versions 09-02 through 09-66-22 HiRDB Server with Additiona...

PT-2026-126315

Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31...

Hitachi HiRDB authorization issue vulnerability

Versions 10-00 through 10-12-01 of Hitachi HiRDB, versions 9-00 through 09-66-22 and earlier of HiRDB Server, versions 9-00 through 09-66/V and earlier of HiRDB Server with Additional Function, versions 9-02 through 09-66-22 and earlier of HiRDB Server Version 9 32, and versions 9-00 through...

Hitachi JP1/Automatic Job Management System 3 authorization issue vulnerability

The Hitachi JP1/Automatic Job Management System versions 3 10-00 through 13-50-31 contain an authorization issue vulnerability. This vulnerability stems from improper authentication mechanisms and may allow attackers to bypass authentication...

PT-2026-126423

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust,...

CVE-2026-116604 SourceCodester Online Food Ordering System delete_admin.php missing authentication

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/deleteadmin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has bee...