PT-2026-85278

MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without...

CVE-2026-14199

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

CVE-2026-14199 Session takeover via Auth Proxy cache key collision

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

CVE-2026-14199 Session takeover via Auth Proxy cache key collision

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

CVE-2026-14199

CVE-2026-14199 affects self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl > 0). The root cause is that the Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter , allowing distinct identities to co...

CVE-2026-84668

Jenkins SAML Plugin 4.618.v441a27fa46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user...

Session takeover via Auth Proxy cache key collision

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

Security Bulletin: Security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. IBM WebSphere Application Server Liberty is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak...

CVE-2026-81777

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

CVE-2026-81777 WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

EUVD-2026-67656

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

CVE-2026-81777

Essential Addons for Elementor (WordPress plugin by WPDeveloper) versions up to and including 6.8.0 are affected by an Authentication Bypass by Spoofing vulnerability that enables Identity Spoofing . The issue was discovered by Gaurav popalghat and scored CVSS 5.3 (MEDIUM) , with a network attack...

CVE-2026-81777 WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

CVE-2026-81777: Authentication Bypass by Spoofing

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

PT-2026-83082

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

CVE-2026-75020 Apache APISIX: ldap-auth plugin cross-subtree identity impersonation

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope...

CVE-2026-75020

This LDAP Injection vulnerability in Apache APISIX's ldap-auth plugin (versions 2.11.0 through 3.17.0 ) allows a caller holding valid credentials for one LDAP directory entry to authenticate as a consumer mapped to a different entry, effectively bypassing the plugin's configured scope and enablin...

CVE-2026-80349

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-79787

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CVE-2026-79787 Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...