CVE-2026-64829 Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow

Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

CVE-2026-4773 OTP Bypass in Magarsus' IDM-MFA

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10...

Malicious code in dev-helper-bg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce930400319131adb4adf9f442340165a52a3ebd8320c497d1de05a3f896cac3 On import devhelper, devhelper/init.py calls startdecryptor at module top level, which spawns a daemon thread running decryptandrun. That function...

Malicious code in make-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e6560048133cc76a9e325b02b2719f89d59c500d09409bb10b6f4afb14401 On import devhelper, the package's init.py starts a daemon thread that runs decryptor.decryptandrun: it fetches an AES-GCM key from the hardcoded...

SUSE-SU-2026:22896-1 Security update for pam

This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290...

Plone 2.5.x < 2.5.2 Multiple Vulnerabilities

The version of Plone installed on the remote host is 2.5.x prior to 2.5.2. It is, therefore, affected by the following vulnerabilities: - Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other...

SUSE SLES12 Security Update : pam (SUSE-SU-2026:3162-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3162-1 advisory. This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290...

SUSE SLED15: pam / pam-32bit / pam-devel / pam-devel-32bit / pam-doc / pam-extra / etc (SUSE-SU-2026:3163-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3163-1 advisory. This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's...

Plone 2.0.x < 2.1.3 Insecure Access Control

The version of Plone installed on the remote host is 2.0.x prior to 2.1.3. It is, therefore, affected by an insecure access control due to not restricting access to the changeMemberPortrait, deletePersonalPortrait, and testCurrentPassword methods. An unauthenticated, remote attacker can exploit...

PT-2026-63532

Summary The DigestAuthentication.apply method in Jetty's HTTP client uses getBytesStandardCharsets.ISO 8859 1 at three locations lines 171, 179, 196 to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF Chinese, Japanese, Cyrillic, Arabic, Emoji, etc. wit...

Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

EUVD-2026-41613

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface...

GHSA-GX3V-Q759-G323 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Summary I'm reporting two related TOTP one-time-use defects in Gitea that survive the CVE-2021-45331 fix. The 2018 fix PR 3878 introduced the TwoFactor.LastUsedPasscode field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-request case,...

EUVD-2026-46430

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web...

EUVD-2026-46407

djangoSIGE through 1.10 commit a6fe7e8 contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can...

CVE-2026-8982

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web...

CVE-2026-64822

djangoSIGE through 1.10 commit a6fe7e8 contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can...

CVE-2026-8982

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware (through version V1.03.51) enabling administrative access to the web management interface. The accounts rely on vendor-defined password derivation mechanisms based on device-specific values, requiring knowledge of th...