MiracleLinux 9 : httpd-2.4.62-13.el9_8.9 (AXSA:2026-2145:11)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2145:11 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via...

Traefik 3.7.10 Digest Authentication Bypass

Traefik versions before 2.11.55 and 3.0.0 through 3.7.10 contain an authentication bypass in the digestAuth middleware that accepts forged digest responses for unknown users. https://packetstorm.news/download/237471...

Parse Platform Parse Server permission and access control issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.104 and versions prior to 9.10.5-alpha.5 contain a permission and access control vulnerability. This vulnerability arises because, when generating SMS multi-factor authentication codes, the entire login request is stored with root privileges. User...

Ivanti Connect Secure 25.1.2.x Authentication Bypass Triage

Ivanti Connect Secure versions 25.1.0.0 through 25.1.1.1, 25.1.2.x before 25.1.3.0, and 22.8R2 through 22.8R2.4 contain an authentication bypass by spoofing. This offline checker triages operator-supplied version data without testing exploitability. https://packetstorm.news/download/237521...

Parse Platform Parse Server authorization issue vulnerability

Versions prior to 8.6.102 and versions 9.0.0 through 9.10.5-alpha.2 of the Parse Platform’s Parse Server contain an authorization issue vulnerability. This vulnerability arises because the validateSetUp, validateLogin, and validateUpdate methods inherited from AuthAdapter are not invoked via cust...

PT-2026-122936

A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be...

Exploit for CVE-2026-114509

CVE-2026-114509 — Laravel TokenGuard Authentication Bypass Pr...

CVE-2026-110956

The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator...

EUVD-2026-109225

The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator...

CVE-2026-110956 asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation

The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator...

CVE-2026-110956

The asVereinbase WordPress plugin, in versions prior to 1.1.8 , contains an authentication bypass vulnerability. The flaw occurs because the plugin fails to require a valid password or a genuine second factor, instead treating an empty stored value as a successful match. This allows an unauthenti...

CVE-2026-110956 asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation

The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator...

Exploit for CVE-2026-114509

CVE-2026-114509 — Laravel TokenGuard authentication bypass PoC...

SonicWall SMA1000 12.5.0-02952 Pre-Authentication Server-Side Request Forgery

SonicWall SMA1000 versions through 12.4.3-03526 and 12.5.0-02952 contain a pre-authentication server-side request forgery vulnerability in the WorkPlace interface...

PT-2026-122500

Name of the Vulnerable Software and Affected Versions asVereinbase WordPress plugin versions prior to 1.1.8 Description The plugin fails to require a valid password or a genuine second factor during user authentication. It treats an empty stored value as a match, allowing an unauthenticated...

NetAlertX 25.4.13 Authentication Bypass

NetAlertX versions before 25.4.14 contain an authentication bypass that allows unauthenticated requests to update application settings. The included proof of concept sends a savesettings request through index.php. https://packetstorm.news/download/237413...

Important: python-jwt

Issue Overview: A flaw was found in PyJWT. A remote attacker can trigger a Denial of Service DoS through outbound request amplification by submitting tokens containing unknown key identifiers. Because the library does not cache lookup failures or enforce a minimum refresh interval when fetching...

MiracleLinux 8 : fetchmail-6.4.24-1.el8_10.1 (AXSA:2026-2138:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2138:01 advisory. fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication fetchmail-SA-2026-01 CVE-2026-94184 Tenable has extracted the preceding description...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: openssh (UTSA-2026-143712)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143712 advisory. sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. Tenable has extracted the preceding description block directly from the Unity Lin...

PHP 8.4.26 Pre-Authentication Remote Code Execution

PHP version 8.4.26 contains out-of-memory handling and use-after-free flaws in request processing. The supplied proof of concept uses crafted HTTP multipart requests to disclose process memory and execute a short command without authentication. https://packetstorm.news/download/237415...