Laravel Framework 12.67.0 TokenGuard Authentication Bypass

Laravel Framework version 12.67.0 contains an authentication bypass in TokenGuard when used with an Eloquent user provider and MySQL or MariaDB. The supplied proof of concept demonstrates authentication with a crafted non-string API token. https://packetstorm.news/download/237410...

Amazon Linux 2 : tomcat (ALAS-2026-4019)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4019 advisory. Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket...

Important: tomcat

Issue Overview: Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The...

SonicWall SMA1000 12.5.0-02952 Cross Site Scripting

SonicWall SMA1000 versions through 12.4.3-03526 and 12.5.0-02952 contain a post-authentication stored cross site scripting vulnerability in the Appliance Management Console...

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_88229)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688229 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer...

Cisco Catalyst SD-WAN Manager 26.2 API Authentication Bypass

Cisco Catalyst SD-WAN Manager versions before the fixed releases contain an API authentication bypass caused by improper URI encoding handling. The included proof of concept details a crafted request that can obtain an administrative API session. https://packetstorm.news/download/237420...

Laravel Framework 13.28.0 TokenGuard Authentication Bypass

Laravel Framework versions before 13.29.0 contain an authentication bypass in TokenGuard on MySQL or MariaDB. This proof of concept submits a non-string API token value that can authenticate as an unintended existing user. https://packetstorm.news/download/237418...

Citrix NetScaler ADC and Gateway 14.1 Authentication Bypass

Citrix NetScaler ADC and Gateway versions before the vendor-provided fixed builds contain an authentication bypass using an alternate path when configured as Gateway or AAA virtual servers, subject to version-specific SAML conditions...

Ivanti Connect Secure 25.1.2.2 Authentication Bypass

Ivanti Connect Secure versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier contain an authentication bypass by spoofing that may allow remote unauthenticated attackers to execute arbitrary commands...

Exploit for Improper Authentication in Nodejs Node.Js

node-cve-2026-56850-check Standalon...

Exploit for Authentication Bypass by Spoofing in Beyondtrust Remote_Support

beyondtrust-remote-support-cve-2026-102764-check...

Exploit for Authentication Bypass by Spoofing in Ivanti Connect_Secure

ivanti-connect-secure-cve-2026-104935-ch...

Exploit for CVE-2026-102255

sonicwall-sma1000-cve-2026-102255-check Stand...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Citrix Netscaler_Application_Delivery_Controller

netscaler-cve-2026-19490-check Standalone d...

Exploit for CVE-2026-94293

CVE-2026-94293 — PoC: Asset Administration Shell Auth Bypass...

Roundcube-webmail-1.6.11-SQLi-PoC

Roundcube 1.6.11 — Pre-Authentication Blind SQL Injection CVE...

EUVD-2026-102952

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint...

EUVD-2026-107583

Laravel TokenGuard authentication bypass through non-string API credentials...

GHSA-F9X3-7VQ9-CPH6 Laravel TokenGuard authentication bypass through non-string API credentials

Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations MySQL/MariaDB an attacker can submit a specially crafted, non-strin...

Laravel TokenGuard authentication bypass through non-string API credentials

Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations MySQL/MariaDB an attacker can submit a specially crafted, non-strin...