Improper Authentication

org.apache.tomcat, tomcat-catalina is vulnerable to Improper Authentication. The vulnerability is due to improper authentication handling in certain authentication mechanisms, which allows an attacker to be authenticated even when the user does not exist in the configured DataSourceRealm...

EUVD-2026-88050

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly availabl...

CVE-2026-101916: Improper Certificate Validation

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

PT-2026-102346

Name of the Vulnerable Software and Affected Versions @grpc/grpc-js versions prior to 1.13.6 @grpc/grpc-js versions prior to 1.14.5 Description The getAuthContext function fails to distinguish between authorized and unauthorized peer certificates when server credentials have...

PT-2026-99900

A security flaw has been discovered in Netcore NR289-GE 1.4.5102. Impacted is an unknown function of the file /bin/boa of the component CGI Dispatcher. Performing a manipulation results in improper authentication. The attack may be initiated remotely. The exploit has been released to the public a...

CVE-2026-101073: Improper Authentication

A security flaw has been discovered in Netcore NR289-GE 1.4.5102. Impacted is an unknown function of the file /bin/boa of the component CGI Dispatcher. Performing a manipulation results in improper authentication. The attack may be initiated remotely. The exploit has been released to the public a...

CVE-2026-100886

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly availabl...

CVE-2026-100886

A vulnerability exists in the Debug Service of Seetong devices, specifically models T8108, T8108P, T8116, and T8232 running version 4.6.1.4-build202604241011 . Manipulation of an unknown function within this component leads to improper authentication . This flaw can be triggered via a remote atta...

CVE-2026-100886 Seetong T8108/T8108P/T8116/T8232 Debug Service improper authentication

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly availabl...

CVE-2026-100886 Seetong T8108/T8108P/T8116/T8232 Debug Service improper authentication

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly availabl...

Improper Authentication

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Improper Authentication via the password login flow in UsersRouter.js when a code-based auth adapter is in use. An attacker...

Exploit for Improper Authentication in Openprinting Cups

CVE-2026-34990 — CUPS local privilege escalation cups2root, d...

Exploit for Improper Authentication in Openprinting Cups

CVE-2026-34990 — CUPS Local-Printer PoC Authorized testin...

CVE-2026-100886: Improper Authentication

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly availabl...

CVE-2026-100871: Improper Authentication

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

CVE-2026-101049: Improper Authentication

Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials...

CVE-2026-101042: Improper Authentication

Parse Server is an open-source backend server. In versions = 9.0.0 = 8.0.2 8.6.91, the code-based authentication adapters GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo verify the client's authorization code with the external provider on signup and on...

CVE-2026-101050: Improper Authentication

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

CVE-2026-94419: Improper Authentication

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

Improper Authentication

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Improper Authentication due to the storage of only a numeric user ID in panel2fatokens without recording the account namespace, and the lookup process during login not being constrain...