CVE-2026-82107

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains multiple vulnerabilities stemming from bundled open-source software. The primary described issue is improper authentication , which allows a remote authenticated attacker to obtain sensitive information and bypass security restrictions. The ass...

CVE-2026-82107 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to improper authentication...

Improper Authentication

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Improper Authentication in the getuserbyoauthsub or getuserbyscimexternalid process. An attacker can gain unauthorized access to another user's account, including administrator accounts, by supplying speciall...

CVE-2026-9176 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources...

EUVD-2026-75724

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources...

CVE-2026-9176

IBM WebSphere Application Server versions 9.0 and 8.5 are vulnerable to a security bypass caused by improper authentication controls, allowing a local attacker to escalate privileges and gain unauthorized access to protected resources. Affected versions are prior to 9.0.5.29 and 8.5.5.31 . The vu...

CVE-2026-6285 Improper Authentication in Ankaref's LIBRID/LIBREF

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319...

CVE-2026-6285 Improper Authentication in Ankaref's LIBRID/LIBREF

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319...

CVE-2026-6285

CVE-2026-6285 is an Improper Authentication vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF , affecting versions 2.01.0.2183 through 10092026 . The root cause is a weak password recovery mechanism for forgotten passwords, allowing remote exploitation of the recovery flow. Th...

Improper Authentication

Spring Security is vulnerable to Improper Authentication. The vulnerability is due to user verification state not being properly maintained with a distributed HTTP session store, allowing an attacker to bypass WebAuthn user verification...

PT-2026-89644

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description Improper authentication may allow a remote authenticated attacker to bypass security restrictions and obtain sensitive information. Recommendations At the moment, there is no...

CVE-2026-77771: Improper Authentication

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

CVE-2026-82107: Improper Authentication

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to improper authentication...

PT-2026-89590

🚨 CVE-2026-9176 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources. 🎖@cveNotify...

CVE-2026-88018: Improper Authentication

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-88018: Improper Authentication

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-88007: Improper Authentication

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection...

CVE-2026-88895: Improper Authentication

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...

Improper Authentication

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Improper Authentication in the LDAP authentication process. An attacker can gain unauthorized access to user accounts by...

CVE-2026-79974

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...