Security update for python-social-auth-core (important)

openSUSE Security Update: Security update for python-social-auth-core Announcement ID: openSUSE-SU-2026:0358-1 Rating: important References: 1282836 1282837 1282838 1282839 1282840 Cross-References: CVE-2026-57175 CVE-2026-57176 CVE-2026-57177 CVE-2026-57178 CVE-2026-57179 Affected Products:...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from authentication issues and improper validation of user attributes, potentially allowing...

Exploit for Improper Privilege Management in Hpe Proliant_Ml10_Gen9_Server_Firmware

C.A.S-Exploit CVE-2017-5689 research and validation toolkit...

Exploit for Incorrect Implementation of Authentication Algorithm in Google Android

CVE-2026-0073 CVE-2026-0073: Android adbd TLS auth bypass PoC...

CVE-2026-0073-Android-ADBD-bypass-POC

CVE-2026-0073 — Android ADBD TLS Auth Bypass EVPPKEYcmp type confusion → unauthorized ADB shell 🔥 Overview A critical authentication bypass in Android's ADB daemon adbd allows any attacker on the local network to obtain a full shell on a target device without user authorization. The vulnerability...

PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws. "What researchers saw was an attack against a European government agency executed in th...

[SECURITY] [DSA 6584-1] varnish security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6584-1 [email protected] https://www.debian.org/security/ Aron Xu October 25, 2026 https://www.debian.org/security/faq -...

Improper Authentication

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Improper Authentication via the loadAuthAdapter function in src/Adapters/Auth/index.js, where custom auth adapters that exte...

CVE-2026-116199

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can si...

ALPINE-CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

CVE-2026-116163

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead...

CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

CVE-2026-116199

Snipe-IT versions prior to 8.6.3 are vulnerable to an authentication bypass within the GoogleAuthController::handleGoogleCallback component. The root cause is the failure to enforce the activated flag when a user logs in via Google SSO; the system logs in any user whose username matches the Googl...

CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can si...

CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can si...

EUVD-2026-109457

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can si...

CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can si...

CVE-2026-116193

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

CVE-2026-116193

Rclone versions 1.64.0 through 1.75.2 are vulnerable to an authentication bypass in the serve webdav functionality. The flaw allows unauthenticated attackers to bypass authentication by sending OPTIONS requests . By probing arbitrary paths and analyzing the Allow header values, attackers can dete...