CVE-2026-101281 Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcsp2findmailfromdomain of the file libopendmarc/opendmarcspf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible...

CVE-2026-101281

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcsp2findmailfromdomain of the file libopendmarc/opendmarcspf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible...

CVE-2026-101281

A flaw in Trusted Domain Project OpenDMARC (up to version 1.4.2) affects the SPF Macro Handler component. Specifically, the function opendmarc_sp2_find_mailfrom_domain within the file libopendmarc/opendmarc_spf.c can be manipulated to cause improper authentication . This vulnerability is exploita...

CVE-2026-102364

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364: Improper Authentication

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-101281: Improper Authentication

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcsp2findmailfromdomain of the file libopendmarc/opendmarcspf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible...

PT-2026-102442

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...

CVE-2026-102248: Improper Authentication

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...

CVE-2026-101269: Improper Authentication

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...

CVE-2026-101281

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcsp2findmailfromdomain of the file libopendmarc/opendmarcspf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible...

PT-2026-102418

Name of the Vulnerable Software and Affected Versions OpenDMARC versions prior to 1.4.3 Description A flaw in the SPF Macro Handler component allows for improper authentication via remote manipulation. The issue resides in the opendmarc sp2 find mailfrom domain function within the...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364

The mall4j framework (through version 4.0 ) contains an improper authentication vulnerability because it fails to validate the sysType field in sa-token sessions. This flaw allows storefront customers to authenticate as back-office users by reusing their own session tokens. An attacker who regist...

CVE-2026-101916

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-101916 @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-101916

The @grpc/grpc-js library (versions prior to 1.13.6 and 1.14.5 ) contains a vulnerability where the getAuthContext function fails to distinguish between authorized and unauthorized peer certificates. This occurs specifically when server credentials have requireClientCertificate set to false . If ...

CVE-2026-101916 @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-101916 @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...