CVE-2026-39324: Improper Authentication

Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie...

PT-2026-114626

Уязвимость компонента Sandbox веб-браузеров Google Chrome и Microsoft Edge связана с неправильной авторизацией. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании с помощью специально созданной HTML-страницы...

Improper Authentication Validation

github.com/mattermost/mattermost-server is vulnerable to improper authentication validation. The vulnerability is due to failure to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated attacker to perform account takeover ...

CVE-2026-35030: Improper Authentication

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.0, when JWT authentication is enabled enablejwtauth: true, the OIDC userinfo cache uses token:20 as the cache key. JWT headers produced by the same signing algorithm generate identical first 20...

EUVD-2026-19089

A vulnerability was determined in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The affected element is the function indexconfig of the file /LoginCB. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may ...

CVE-2026-5570

CVE-2026-5570 affects Technostrobe HI-LED-WR120-G2 firmware version 5.5.0.1R6.03.30. The vulnerability is in the function index_config of the file /LoginCB, leading to improper authentication. It can be triggered remotely and public disclosures of the exploit exist. Multiple sources confirm the i...

CVE-2026-5570 Technostrobe HI-LED-WR120-G2 LoginCB index_config improper authentication

A vulnerability was determined in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The affected element is the function indexconfig of the file /LoginCB. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may ...

CVE-2026-5570 Technostrobe HI-LED-WR120-G2 LoginCB index_config improper authentication

A vulnerability was determined in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The affected element is the function indexconfig of the file /LoginCB. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may ...

PT-2026-30439

Name of the Vulnerable Software and Affected Versions Technostrobe HI-LED-WR120-G2 version 5.5.0.1R6.03.30 Description A flaw exists in the index config function within the /LoginCB file, leading to improper authentication. This issue is remotely exploitable, and details of the exploit have been...

CVE-2026-5570: Improper Authentication

A vulnerability was determined in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The affected element is the function indexconfig of the file /LoginCB. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may ...

Technostrobe HI-LED-WR120-G2 Authorization Issue Vulnerability

Technostrobe HI-LED-WR120-G2 is a high-brightness industrial strobe lighting device from the Canadian company Technostrobe. The version 5.5.0.1R6.03.30 of Technostrobe HI-LED-WR120-G2 contains an authorization issue vulnerability, which stems from improper authentication procedures...

CVE-2026-32173

Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network...

CVE-2026-32173

Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network...

CVE-2026-34990: Improper Authentication

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That...

CVE-2026-4829

Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow...

Azure SRE Agent Information Disclosure Vulnerability

Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network...

CVE-2026-34736: Improper Authentication

Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users...

CVE-2026-32173: Improper Authentication

Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network...

CVE-2026-34834: Improper Authentication

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings vi...

Microsoft Azure SRE Agent authorization issue vulnerability

Microsoft Azure SRE Agent is a backend agent service provided by Microsoft Corporation in the United States, designed for monitoring, managing, and optimizing the operational status of the Azure platform. There is an authorization issue vulnerability in Microsoft Azure SRE Agent; this vulnerabili...