CVE-2026-126777 Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in vi...

EUVD-2026-123771

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in vi...

CVE-2026-126777

Traccar version 3.15 before 6.17.0 is vulnerable to an authentication bypass in the LdapProvider.login() function. The root cause is a failure to reject empty passwords when LDAP authentication is enabled, allowing the system to perform unauthenticated binds against directories that permit them. ...

CVE-2026-126777: Traccar: Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject…

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in vi...

PT-2026-145645

This module enables you to require a second authentication factor a time-based one-time password from an authenticator app when users log in. The module doesn't sufficiently enforce the second factor for authentication providers that authenticate every request on their own. An attacker who knows...

PT-2026-145429

Name of the Vulnerable Software and Affected Versions Traccar versions 3.15 through 6.16.x Description An authentication bypass exists in the LdapProvider.login function when LDAP authentication is enabled. The system fails to reject empty passwords, which leads to LDAP binds being performed as...

CVE-2026-8181

CVE-2026-8181 Proof of Concept Research • Validation • Security Testing "roses a red, violet are blue, i think i just shat my pant thinking about you. rizz" CVE Overview Field| Value ---|--- CVE ID| CVE-2026-8181 Type| Authentication Bypass Impact| Privilege Escalation / Full Site Takeover Attack...

CVE-2026-97880

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

CVE-2026-97880 Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

EUVD-2026-121261

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

CVE-2026-97880

The embedded OpenEJB HTTP server in Apache TomEE is vulnerable to an authentication bypass affecting REST endpoints configured with HTTP Basic authentication . The root cause is that the server dispatches certain requests to these endpoints without verifying credentials. A remote unauthenticated ...

CVE-2026-107241

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default...

CVE-2026-107241

The Node.js web service on Versa VOS (formerly Versa FlexVNF) is vulnerable to unauthorized access due to the use of default credentials and HTTP Basic Authentication during initial Zero Touch Provisioning (ZTP) . An attacker with network access who possesses these credentials can authenticate to...

EUVD-2026-120627

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default...

CVE-2026-107241

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default...

PT-2026-141790

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

CVE-2026-107241: Versa VOS: The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the…

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default...

PT-2026-141236

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default...

CVE-2026-97880: Apache Software Foundation Apache TomEE: The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication…

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

CVE-2026-84473

Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint...