PaperCut NG < 25.0.13 / 26.x < 26.0.5 Multiple Vulnerabilities

The version of PaperCut NG installed on the remote Windows host is prior to 25.0.13, or 26.x prior to 26.0.5. It is, therefore, affected by the following vulnerabilities: - An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of...

PaperCut MF < 25.0.13 / 26.x < 26.0.5 Multiple Vulnerabilities

The version of PaperCut MF installed on the remote Windows host is prior to 25.0.13, or 26.x prior to 26.0.5. It is, therefore, affected by the following vulnerabilities: - An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of...

tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure

A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized...

PYSEC-2026-4167 social-auth-core has an Improper Authentication issue

Impact The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

social-auth-core has an Improper Authentication issue

ImpactThe SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest.Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

LiteLLM: MCP Proxy Has Improper Authentication

A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/experimental/mcpserver/auth/userapikeyauthmcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched...

PYSEC-2026-4067 LiteLLM: MCP Proxy Has Improper Authentication

A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/experimental/mcpserver/auth/userapikeyauthmcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched...

tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure

A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized...

CVE-2026-94276

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

CVE-2026-94276 Apache APISIX: Openid-connect introspection validation issue

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

CVE-2026-94276 Apache APISIX: Openid-connect introspection validation issue

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

EUVD-2026-90769

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

CVE-2026-94276

Apache APISIX versions 3.12.0 through 3.18.0 are vulnerable to an Improper Authentication issue in the openid-connect plugin . When using remote introspection against an authorization server supporting multiple issuers, a token valid for one issuer may be incorrectly accepted on a route restricte...

BIT-TOMCAT-2026-75973 Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

PT-2026-105823

A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/ experimental/mcp server/auth/user api key auth mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be...

PT-2026-103835

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.12.0 through 3.18.0 Description Improper Authentication occurs when using the openid-connect plugin with remote introspection against an authorization server that serves multiple issuers. In this scenario, a token that...

Rocky Linux 9 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2022_7935)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227935 advisory. pcs: improper authentication via PAM CVE-2022-1049 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus h...

CVE-2026-94276: Improper Authentication

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

PT-2026-105205

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2022_7447)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227447 advisory. pcs: improper authentication via PAM CVE-2022-1049 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus h...