RHEL 9 : curl (RHSA-2026:55439)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55439 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including...

PT-2026-73435

SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer signing.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey,...

ALSA-2026:55424 Important: 389-ds-base security update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status...

Important: gnome-remote-desktop

Issue Overview: A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel...

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl:...

CVE-2026-74867: Cross-Site Request Forgery (CSRF)

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

CVE-2026-56677: Missing Authentication for Critical Function

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

PT-2026-76808

Name of the Vulnerable Software and Affected Versions SkyPilot affected versions not specified Description An authorization bypass exists where the system fails to validate if authenticated users have the necessary entitlements to grant administrator roles when updating service account permission...

PT-2026-76806

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full repor...

PT-2026-76725

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x astro path for the public / isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

ROS-20260817-73-0201

The vulnerability in xrdp is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

ALSA-2026:55432 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: Information disclosure due to uncleared proxy authentication state CVE-2026-8927 For more details about the security...

CVE-2026-19977: Improper Authentication

A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpconchecksessionurl of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and ma...

PT-2026-76722

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description The REST API server contains a flaw in its safety check designed to prevent the combination of cors credentials=True and an unrestricted CORS origin allowlist. The check in glances/outputs/glances...

PT-2026-76626

openssl encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST CURRENT TEST environment variable is set. Attackers with code execution can set this environment variable to produce...

PT-2026-76628

openssl encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication...

PT-2026-76825

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.15.0 Description Authenticated users can bypass experiment-level READ permissions to access arbitrary files from another user's artifact directory. The issue occurs because the validate source run and validate source...

Important: dotnet9.0

Issue Overview: Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47303 Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-74894: Improper Authentication

opensslencrypt before 1.4.0 contains an authentication bypass vulnerability in the verifyapitoken function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bear...

CVE-2026-65329: Improper Authentication

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, iOS 27 and iPadOS 27. An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic...