CVE-2026-90601

An improper authentication vulnerability exists in getzep graphiti (up to version 0.30.2), affecting the REST API component in the file server/graph_service/main.py. The root cause is an unknown function that fails to properly authenticate requests, allowing remote attackers with no privileges to...

CVE-2026-90601 getzep graphiti REST API main.py improper authentication

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graphservice/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits...

CVE-2026-90601 getzep graphiti REST API main.py improper authentication

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graphservice/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits...

PT-2026-90957

Name of the Vulnerable Software and Affected Versions Dell ECS versions 3.8.1.0 through 3.8.1.7 Dell ObjectScale versions prior to 4.4.0.0 Description Improper Privilege Management allows a high privileged attacker with local access to potentially achieve elevation of privileges. Recommendations...

CVE-2026-89080: Improper Authentication

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to...

PT-2026-90955

Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken or Risky Cryptographic Algorithm vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure...

PT-2026-90956

Name of the Vulnerable Software and Affected Versions Dell ObjectScale versions prior to 4.4.0.0 Description An improper authentication issue allows an unauthenticated attacker with remote access to potentially gain unauthorized access to the system. Recommendations Update Dell ObjectScale to...

CVE-2026-90601: Improper Authentication

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graphservice/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits...

PT-2026-90985

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph service/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits...

CVE-2026-75800: Improper Authentication

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts...

CVE-2026-79395

An improper authentication vulnerability in the WS-Security wsse:UsernameToken verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions including...

Security Bulletin: The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Improper Access Control (CVE-2026-19273)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-19273 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a remote authenticated attacker to bypass security restrictions due to...

CVE-2026-54047

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by trusting the UID field inside the...

CVE-2026-54047 Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by trusting the UID field inside the...

EUVD-2026-76152

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by trusting the UID field inside the...

CVE-2026-54047 Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by trusting the UID field inside the...

Exploit for Improper Authentication in Hikvision Ds-2Cd2032-I_Firmware

CVE-2017-7921 Exploit exploit tool for the Hikvision imp...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-42016link is external JFrog Artifactory Incorrect Authorization Vulnerability CVE-2026-42018link is external JFrog Artifactory Improper Authentication...

BIT-TOMCAT-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, fr...

BIT-TOMCAT-2026-55955 Apache Tomcat: EncryptInterceptor not protected against replay attacks

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from...