PT-2026-123437

A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor w...

Android 16 QPR2 Wireless Debugging Authentication Bypass

Android versions 14, 15, 16, and 16 QPR2 contain a wireless ADB mutual-authentication bypass in adbd that permits adjacent-network shell-user code execution. This proof of concept opens an unauthenticated shell. https://packetstorm.news/download/237655...

Oracle Linux 10 : httpd (ELSA-2026-89860)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89860 advisory. - Related: RHEL-275253 - httpd: Arbitrary code execution via oversized Host header in modvhostalias CVE-2026-63292 - Resolves: RHEL-280355 - httpd:...

Siemens Mendix SAML Module

SUMMARY Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and...

Security update for python-social-auth-core (important)

openSUSE Security Update: Security update for python-social-auth-core Announcement ID: openSUSE-SU-2026:0358-1 Rating: important References: 1282836 1282837 1282838 1282839 1282840 Cross-References: CVE-2026-57175 CVE-2026-57176 CVE-2026-57177 CVE-2026-57178 CVE-2026-57179 Affected Products:...

Apple MacOS: CVE-2026-86958: OS X update for dyld

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code...

Exploit for Improper Privilege Management in Hpe Proliant_Ml10_Gen9_Server_Firmware

C.A.S-Exploit CVE-2017-5689 research and validation toolkit...

Exploit for Incorrect Implementation of Authentication Algorithm in Google Android

CVE-2026-0073 CVE-2026-0073: Android adbd TLS auth bypass PoC...

CVE-2026-0073-Android-ADBD-bypass-POC

CVE-2026-0073 — Android ADBD TLS Auth Bypass EVPPKEYcmp type confusion → unauthorized ADB shell 🔥 Overview A critical authentication bypass in Android's ADB daemon adbd allows any attacker on the local network to obtain a full shell on a target device without user authorization. The vulnerability...

PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws. "What researchers saw was an attack against a European government agency executed in th...

[SECURITY] [DSA 6584-1] varnish security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6584-1 [email protected] https://www.debian.org/security/ Aron Xu October 25, 2026 https://www.debian.org/security/faq -...

Improper Authentication

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Improper Authentication via the loadAuthAdapter function in src/Adapters/Auth/index.js, where custom auth adapters that exte...

CVE-2026-116199

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can si...

ALPINE-CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

CVE-2026-116163

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead...

CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

CVE-2026-116199

Snipe-IT versions prior to 8.6.3 are vulnerable to an authentication bypass within the GoogleAuthController::handleGoogleCallback component. The root cause is the failure to enforce the activated flag when a user logs in via Google SSO; the system logs in any user whose username matches the Googl...

CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can si...

CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can si...