174746 matches found
CVE-2026-16905
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication...
CVE-2026-16905 IBM Db2 Mirror for i is affected by multiple vulnerabilities
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication...
CVE-2026-16905
CVE-2026-16905 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. Description: a remote authenticated attacker could obtain sensitive information due to improper authentication. CVSS v3.1 base score 5.3 (MEDIUM), vectors: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Root cause: improper authenticat...
CVE-2026-50027
mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key MCPAPIKEY or OAuth. An unauthenticated remote...
CVE-2026-73679
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...
CVE-2026-50027
CVE-2026-50027 describes a missing authentication flaw in mcp-memory-service where all HTTP routes under /api/documents/* are accessible without credentials prior to version 10.67.1. An unauthenticated attacker can perform write, read, and delete operations on stored memories, bypassing the inten...
CVE-2026-50027
mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key MCPAPIKEY or OAuth. An unauthenticated remote...
CVE-2026-50027 mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete
mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key MCPAPIKEY or OAuth. An unauthenticated remote...
40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin
On July 14th, 2026, we received a submission for an Authentication Bypass vulnerability in User Profile Builder, a WordPress plugin with more than 40,000 active installations. This vulnerability makes it possible for unauthenticated attackers to log in as the user with ID 1, which is typically th...
CVE-2026-49457
erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...
MINI-QVR9-WX86-8XGH
Bulletin has no description...
CVE-2026-46405
A flaw was found in OpenBao, an identity-based secrets management system. When the Kerberos authentication method processes a GET request or an Authorization: Negotiate header, it inadvertently creates authentication tokens that are not accessible to the caller and are hidden by an error message...
SUSE CVE-2026-68300
In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...
Security Bulletin: Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow
Summary The POST /api/v2/registration/ endpoint in affected versions lacked authentication requirements, allowing unauthenticated attackers to overwrite the server's registered admin email address and trigger outbound telemetry calls to external servers, enabling the Langflow instance to be abuse...
Improper Verification Of Cryptographic Signature
Spring Security is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to SAML Responses and LogoutRequest/LogoutResponse elements being decrypted without requiring a valid signature, which allows an attacker to craft malicious SAML payloads and use the Servic...
[SECURITY] [DLA 4740-1] postgresql-15 security update
Debian LTS Advisory DLA-4740-1 [email protected] https://www.debian.org/lts/security/ Carlos Henrique Lima Melara August 14, 2026 https://wiki.debian.org/LTS Package : postgresql-15 Version : 15.19-0+deb12u1 CVE ID : CVE-2025-8714 CVE-2026-6464 CVE-2026-6469 CVE-2026-6470 CVE-2026-6471...
CVE-2026-49826 Concourse login flow has an open redirect issue
Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...
CVE-2026-66272
Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...
CVE-2025-6010
creationtimestamp| type| source ---|---|--- 2026-08-14 16:00:22+00:00| seen| https://t.me/devsecopsweekly/1310 2026-08-15 00:00:46+00:00| seen| https://t.me/devsecopsweekly/1310 2026-08-16 00:00:50+00:00| published-proof-of-concept| https://t.me/devsecopsweekly/1310...