tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

CVE-2023-24035

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

PT-2026-91218

The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP's FormAuthenticate class but fail to replicate its checkFields input validation guard. As a result, the email and password fields...

PT-2026-91436

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication...

CVE-2023-24035

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

CVE-2023-24035: Observable Timing Discrepancy

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

PT-2026-91087

Plaintext storage of a password issue exists in CONPROSYS nano Series . If this vulnerability is exploited, an attacker with physical access to the product may obtain credentials...

PT-2026-91766

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/Login Model.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

CVE-2026-90939: Missing Authorization

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

ROS-20260914-73-0101

The vulnerability of the Password component in the Google Chrome browser is related to a flaw in data protection mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to protected information through a specially created HTML page...

ROS-20260914-73-0033

The vulnerability of the Password Manager component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to gain access to confidential data through a specially created HTML page...

PT-2026-91243

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

PT-2026-91859

Name of the Vulnerable Software and Affected Versions 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery versions prior to 1.16.21 Description Unauthenticated attackers can extract sensitive data from password-protected flipbooks by exploiting the id parameter. This allows th...

PT-2026-91038

An issue was discovered in Nagios XI before 5.9.3. The is insecure login authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

CVE-2026-17628: Improper Authentication

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication...

PT-2026-95190

Name of the Vulnerable Software and Affected Versions SOGo versions prior to 5.12.11 Description Unauthenticated attackers can redirect password recovery tokens to domains under their control. This occurs because the software constructs password-reset links using the client-supplied Origin header...

PT-2026-91244

Name of the Vulnerable Software and Affected Versions novel-plus versions prior to 5.3.4 Description An insecure default cache-management password exists in the 'CacheController.refreshCache' endpoint. Anonymous attackers can invalidate portal caches by providing the hardcoded default value in th...

ROS-20260914-73-0095

The vulnerability of the Password component in Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions through a specially created HTML page...