CVE-2026-108157

Pingvin Share X versions 0.19.0 before 1.22.0 are vulnerable to an improper authentication flaw in the OAuthService.signUp() function. The root cause is a missing email_verified check in the GenericOidcProvider, which allows unauthenticated remote attackers to perform an account takeover . By reg...

EUVD-2026-95905

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp. Attackers can register a victim's unverified email on an enabled OAuth/OI...

Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 CVSS v4 score: 5.5 - An improper authentication...

CVE-2026-107910

An improper authentication vulnerability in the isauthenticated function src/bolt/boltapi.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an...

EUVD-2026-95487

An improper authentication vulnerability in the isauthenticated function src/bolt/boltapi.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an...

CVE-2026-19494

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication...

CVE-2026-16823 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication...

EUVD-2026-95282

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication...

CVE-2026-19494 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication...

CVE-2026-19494

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) are vulnerable to a security restriction bypass. This issue stems from improper authentication , which could be exploited by a remote authenticated attacker . The impact inclu...

EUVD-2026-95276

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication...

Exploit for Improper Authentication in Influxdata Influxdb

InfluxDB Empty JWT Secret Authentication Bypass CVE-2019-2093...

CVE-2026-11387-WooCommerce-SMS-OTP

CVE-2026-11387 SMS Alert ≤ 3.9.5 - تصعيد صلاحيات غير مُصادَق عليه عبر إعادة تعيين كلمة المرور التعسفية ثغرة حرجة في المصادقة غير الصحيحة في إضافة ووردبريس SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery. عند تفعيل التحقق عبر OTP لإعادة تعيين كلمات المرور، يمكن...

cve-2026-29145

CVE-2026-29145 — فحوصات OCSP تفشل أحيانًا بشكل ناعم حتى عند تعطيل الفشل الناعم المكتشف: gregk4sec https://github.com/gregk4sec/cve تاريخ الاكتشاف: 2026-02-26 البائع المتأثر: Apache المنتج المتأثر: Tomcat الخطورة: 9.1 حرجة CWE: CWE-287 مصادقة غير صحيحة الحالة: قيد المراجعة / تم الإصلاح / خاص / عام...

CVE-2026-14502

The IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 are vulnerable to an improper authentication flaw. The root cause is a failure to reject empty passwords during LDAP authentication , which could allow a...

CVE-2026-14502 IBM DataPower Gateway Improper Authentication

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication...

CVE-2025-63667

CVE-2025-63667 — Vatilon-आधारित IP कैमरा भेद्यता साक्ष्य स्वच्छ सारांश कई Vatilon-आधारित IP कैमरे देखे गए ब्रांड: SIMICAM, KEVIEW, ASECAM क्रेडेंशियल सहीता की पुष्टि किए बिना Session-Id टोकन जारी करते हैं। यह दोष अप्रमाणित हमलावरों को वैध सत्र प्राप्त करने और खुले API एंडपॉइंट्स के माध्यम से...

ZenML ZenML Server - Improper Authentication

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/usernameorid/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. id: CVE-2024-25723 info:...

SSL VPN Session Hijacking

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. id: CVE-2024-53704 info: name: SSL VPN Session Hijacking author: johnk3r severity: critical description: | An Improper Authentication vulnerability in the SSLVPN...

PT-2026-107997

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...