EUVD-2026-64690

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpconchecksessionurl of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed...

CVE-2026-78168

EFM ipTIME T24000M routers running firmware up to 14.20.0 are affected by an improper authentication vulnerability in the function httpcon_check_session_url within the Session Validation Handler . The flaw allows a remote, unauthenticated attacker to bypass session validation without user interac...

EUVD-2026-64687

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpconchecksessionurl of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made availab...

CVE-2026-78167

EFM ipTIME T16000M (firmware 14.20.2 ) contains an improper authentication vulnerability in the httpcon_check_session_url function of the Session Validation Handler . The flaw allows remote exploitation over the network with no privileges required and low complexity , rated CVSS 4.0: 10.0 (CRITIC...

CVE-2026-78167 EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpconchecksessionurl of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made availab...

EUVD-2026-64673

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeeminvitationcode of the file backend/app/api/routes/v1/userinvitationcode.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing...

CVE-2026-78154

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The endpoint is public on purpose and the invitation code is the credential. This is the standalone SD...

PT-2026-79805

Name of the Vulnerable Software and Affected Versions EFM ipTIME T24000M versions prior to 14.20.0 Description Improper authentication exists in the Session Validation Handler component. A remote attacker can manipulate the httpcon check session url function to bypass authentication mechanisms...

PT-2026-80920

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

PT-2026-80926

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who...

PT-2026-81053

Name of the Vulnerable Software and Affected Versions CakePHP Authentication versions prior to 2.11.2 CakePHP Authentication versions 3.0.0 through 3.3.6 CakePHP Authentication versions 4.0.0 through 4.2.0 Description An authentication bypass and potential CPU or memory exhaustion can occur when...

PT-2026-79804

Name of the Vulnerable Software and Affected Versions EFM ipTIME T16000M version 14.20.2 Description Improper authentication occurs within the Session Validation Handler component due to a weakness in the httpcon check session url function. This flaw allows remote exploitation to bypass...

CVE-2026-78154

...

CVE-2026-78154

A missing authentication issue was reported in the-momentum open-wearables (up to 0.6.2 ), affecting the redeem_invitation_code function in the Public Invitation-Code Redemption Endpoint (backend/app/api/routes/v1/user_invitation_code.py). The manipulation of the code argument was described as al...

CVE-2026-78154

...

CVE-2026-78154 the-momentum open-wearables Public Invitation-Code Redemption Endpoint user_invitation_code.py redeem_invitation_code missing authentication

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeeminvitationcode of the file backend/app/api/routes/v1/userinvitationcode.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing...

CVE-2026-19565

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...

CVE-2026-19565 Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...

EUVD-2026-64663

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...

CVE-2026-19565

Apache::AppSamurai::Util (Perl, versions through 1.01 ) contains a vulnerability in CreateSessionAuthKey that generates predictable session authentication keys. The function derives keys from Time::HiRes microsecond readings and the process ID , both of which have a small entropy space. Since Cre...