CVE-2026-60722: Missing Authentication for Critical Function

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle...

CVE-2026-70922: Improper Authentication

Vulnerability in the Oracle Financial Services Enterprise Case Management product of Oracle Financial Services Applications component: Web UI. Supported versions that are affected are 8.0.8.2 and 8.1.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTT...

CVE-2026-70973: Missing Authentication for Critical Function

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Installation and Configuration. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromis...

CVE-2026-70918: Missing Authentication for Critical Function

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Outbound Data. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful...

CVE-2026-70930: Missing Authentication for Critical Function

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite component: Product Diagnostic Tools. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order...

CVE-2026-62640: Improper Access Control

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware component: Security and Authentication. The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle Report...

CVE-2026-62635: Improper Access Control

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware component: Security and Authentication. The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Report...

CVE-2026-73399: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...

CVE-2026-72130

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

CVE-2026-15741

creationtimestamp| type| source ---|---|--- 2026-08-17 22:35:09+00:00| seen| https://bsky.app/profile/securitylab-jp.bsky.social/post/3mtcr64c5zk2n 2026-08-20 17:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtjqaefa4u2f...

CVE-2026-69146

creationtimestamp| type| source ---|---|--- 2026-08-17 22:35:05+00:00| published-proof-of-concept| https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5 2026-08-17 23:31:40+00:00| seen| https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a 2026-08-18 00:01:16+00:00|...

CVE-2026-65329

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, iOS 27 and iPadOS 27. An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic...

GHSA-VXXM-WWQH-MH47 http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

Impact An issue in DigestAuthProvider.verify: Algorithm silently forced to MD5. The configured algorithm parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses...

http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

Impact An issue in DigestAuthProvider.verify: Algorithm silently forced to MD5. The configured algorithm parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses...

GHSA-MPWR-8VM7-H73F package pkcs12: Authentication bypass in Decode functions

Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS12 files from untrusted sources and rely on the password for authentication can be tricke...

package pkcs12: Authentication bypass in Decode functions

Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS12 files from untrusted sources and rely on the password for authentication can be tricke...

libssh: libssh: denial of service via automatic certificate authentication loop

A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service...

Important: Red Hat Security Advisory: libssh security update

An update for libssh is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

libssh: libssh: authentication bypass via missing GSSAPI principal check

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users...

CVE-2026-65329

CVE-2026-65329 is an authentication vulnerability in the Telephony subsystem of Apple's iOS and iPadOS, affecting iPhone 11 and later . The root cause is a state management flaw that allows an attacker in a privileged network position to bypass IPSec authentication and intercept network traffic. ...