Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Business Automation Workflow

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

PT-2026-108234

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description A remote authenticated attacker can bypass additional authentication workflow steps. Recommendations At the moment,...

CVE-2026-107102 Account Takeover Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...

VulnCheck KEV: CVE-2023-54403

Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this...

PT-2026-103593

Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this...

PT-2026-102914

Name of the Vulnerable Software and Affected Versions Pgpool-II versions prior to 4.7.3 Description An improper certificate validation issue exists that may allow an unauthenticated attacker to bypass client certificate authentication. Approximately 101 instances have been identified globally...

UBUNTU-CVE-2026-89136

When using RPK Raw Public Key, the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited servercerttype=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR...

UBUNTU-CVE-2026-93302

MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSLTRUSTPEERCERT and load CA certificates with wolfSSLCTXtrustpeercert or wolfSSLtrustpeercert. The peer must know the certificates being loaded to...

PT-2026-94092

Name of the Vulnerable Software and Affected Versions TCH QRing smart ring model R20 B006 version RT09R20 1.00.00 250318 Description The device contains an unauthenticated Bluetooth Low Energy access issue. A nearby attacker can connect to the device without pairing, authentication, or user...

CVE-2026-77550: Improper Neutralization of CRLF Sequences

A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances...

CVE-2026-72691

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...

EUVD-2025-210622

My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...

CVE-2026-7557 SAML authentication bypass in Progress MarkLogic Server

An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affec...

CVE-2026-49331

CVE-2026-49331 concerns openshift/oauth-proxy, where on paths configured to bypass authentication (skip-auth-regex) the proxy forwards client-supplied identity headers (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token) to the upstream application without stripping them. An unauthenti...

CVE-2026-71231

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safedecode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated...

PT-2026-68114

Name of the Vulnerable Software and Affected Versions Inventory-Management-System-PHP affected versions not specified Description The software contains SQL injection flaws in two separate components. The 'login.php' endpoint constructs authentication queries using direct string concatenation of r...

PT-2026-68097

Name of the Vulnerable Software and Affected Versions IOTSmartHome affected versions not specified Description The checkCookie function in the 'gui/login.php' endpoint is susceptible to SQL injection. The issue occurs when the system processes the lastLogin cookie using the safe decode function,...

CVE-2025-63823: Use of Hard-coded Credentials

My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...

PT-2026-68341

Name of the Vulnerable Software and Affected Versions My Safetipin Android Application version 5.2.1 Description The authentication module contains hardcoded credentials. This flaw allows remote attackers to bypass authentication and gain unauthorized access to user accounts by using predictable...

CVE-2026-9190: Inconsistent Interpretation of HTTP Requests

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...