ROS-20261026-73-0154

The vulnerability in openssh is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

UBUNTU-CVE-2026-114645

A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side...

PT-2026-123279

Name of the Vulnerable Software and Affected Versions Mendix SAML Mendix 10 compatible versions prior to 4.2.4 Mendix SAML Mendix 11 compatible versions prior to 4.2.4 Mendix SAML Mendix 9 compatible versions prior to 3.6.29 Description The module fails to properly protect against SAML assertion...

PT-2026-125141

An authentication issue was addressed with improved validation of user attributes. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges...

PT-2026-125404

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. A malicious app may be able to access Bluetooth without user consent...

Siemens Mendix SAML Module

SUMMARY Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and...

Security update for python-social-auth-core (important)

openSUSE Security Update: Security update for python-social-auth-core Announcement ID: openSUSE-SU-2026:0358-1 Rating: important References: 1282836 1282837 1282838 1282839 1282840 Cross-References: CVE-2026-57175 CVE-2026-57176 CVE-2026-57177 CVE-2026-57178 CVE-2026-57179 Affected Products:...

Apple MacOS: CVE-2026-86958: OS X update for dyld

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from memory handling issues, which may allow attackers with memory write capabilities to bypass...

PT-2026-125078

OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider...

PT-2026-125496

Name of the Vulnerable Software and Affected Versions Kener versions 3.0.0 through 4.1.9 Description An authentication bypass exists when the KENER SECRET KEY is empty or unset, causing the system to use a hardcoded DUMMY SECRET fallback key. This allows unauthenticated attackers who know an...

PT-2026-123156

A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely...

PT-2026-123298

This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a val...

ROS-20261026-73-0159

The OpenSSH software mechanism for managing VMware vCenter Server’s virtual infrastructure contains a vulnerability that can lead to service interruptions during authentication processes. A service interruption occurs when the values of logingraceTime and maxStartup differ from the default values...

PT-2026-125442

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code...

UBUNTU-CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

PT-2026-125110

Name of the Vulnerable Software and Affected Versions jose versions 1.2.0 through 1.11.12 Description The pure-Erlang AES-GCM fallback in jose jwa aes derives the number of verified authentication tag bits from the attacker-supplied tag. In the aes gcm, Bits clause of the block decrypt/4 function...

PT-2026-123335

Name of the Vulnerable Software and Affected Versions danmu api versions prior to 1.21.7 Description An authentication bypass occurs when the default TOKEN is used and the ADMIN TOKEN is unset. This allows unauthenticated attackers to modify server environment configurations by sending POST...

PT-2026-123437

A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor w...

Android 16 QPR2 Wireless Debugging Authentication Bypass

Android versions 14, 15, 16, and 16 QPR2 contain a wireless ADB mutual-authentication bypass in adbd that permits adjacent-network shell-user code execution. This proof of concept opens an unauthenticated shell. https://packetstorm.news/download/237655...