CVE-2026-107194: Authentication Bypass Using an Alternate Path or Channel

Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "logintype":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the useraccount property is required; however, a user can view the email addres...

Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...

PT-2026-107466

Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE...

CVE-2026-97720: Incorrect Implementation of Authentication Algorithm

Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token JWT signatures are...

PT-2026-107700

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description An authorization bypass exists in the Representational State Transfer REST API. A user with the edit...

PT-2026-107716

Name of the Vulnerable Software and Affected Versions Vault Community Edition versions prior to 2.1.2 Vault Enterprise versions prior to 2.1.2 Vault Enterprise versions prior to 1.21.12 Vault Enterprise versions prior to 1.20.17 Vault Enterprise versions prior to 1.19.23 Description An issue exis...

PT-2026-107717

Name of the Vulnerable Software and Affected Versions pgjdbc versions 42.7.11 through 42.7.13 Description The PostgreSQL JDBC Driver fails to enforce restrictions when the requireAuth connection property excludes all six known authentication methods e.g.,...

PT-2026-107527

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...

PT-2026-107568

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 ImageMagick versions prior to 6.9.13-56 Description A crafted image can bypass a security policy that uses coder as its domain, which may allow the reading of data prohibited by that policy. Recommendatio...

Linux Distros Unpatched Vulnerability : CVE-2026-106327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system acce...

Linux Distros Unpatched Vulnerability : CVE-2026-106322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a...

Security update for golang-github-prometheus-alertmanager (important)

openSUSE security update: security update for golang-github-prometheus-alertmanager ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22027-1 Rating: important References: bsc1266615 bsc1269834 Cross-References: CVE-2026-2303 CVE-2026-39821 CVSS score...

CVE-2026-107228: Improper Authentication

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

MiracleLinux 9 : nodejs:24 (AXSA:2026-1984:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1984:01 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificat...

Security update for prometheus-blackbox_exporter (important)

openSUSE security update: security update for prometheus-blackboxexporter ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22026-1 Rating: important References: bsc1236515 bsc1238680 bsc1266556 bsc1279126 Cross-References: CVE-2023-45288 CVE-2025-228...

SUSE SLES12 Security Update : docker-stable (SUSE-SU-2026:4533-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4533-1 advisory. - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header...

PT-2026-107678

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.1.0 through 3.0.13 Description The enabled-by-default cookie store in the AsyncHttpClient library replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contributes any cookie...

RHEL 8 : python3.12 (RHSA-2026:77028)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77028 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Linux Distros Unpatched Vulnerability : CVE-2026-101258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell...

SUSE SLES15: docker-stable / docker-stable-bash-completion / etc (SUSE-SU-2026:4535-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4535-1 advisory. - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header...