116 matches found
CVE-2026-43640
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session...
CVE-2026-6848
A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle...
CVE-2026-6848
Summary: CVE-2026-6848 affects Red Hat Quay. The vulnerability allows bypassing the re-authentication prompt for password‑reverification during sensitive operations (e.g., token generation, robot account creation) when a user has a timed‑out session or idle authenticated browser session. This can...
PT-2026-34319
Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A flaw exists where the password re-verification prompt for sensitive operations, such as token generation or robot account creation, can be bypassed. This allows a user with a timed-out...
Red Hat Quay 代码问题漏洞
Red Hat Quay is a distributed container image repository provided by the American company Red Hat. It is primarily used for building, distributing, and deploying containers. Red Hat Quay 3 has code-related vulnerabilities. These vulnerabilities arise from the ability to bypass the re-authenticati...
Keycloak 安全漏洞
Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a security vulnerability, which stems from the fact that disabled SAML clients can still complete the login process. This could allow remote attackers to gain unauthorized access to other enable...
PT-2026-6047
Name of the Vulnerable Software and Affected Versions Foxit PDF Editor Cloud versions prior to 2026-02-03 Description Foxit PDF Editor Cloud pdfonline contains a stored cross-site scripting issue in the file upload feature. A malicious username is embedded into the upload file list without proper...
CVE-2025-6597 MediaWiki should not consider autocreation as login for the purposes of security reauthentication
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects MediaWiki: from before 1.39.13, 1.42.7, 1.43.2, 1.44.0...
CVE-2025-6597
CVE-2025-6597 affects Wikimedia Foundation MediaWiki, specifically the authentication management component in includes/auth/AuthManager.Php. The vulnerability is listed for MediaWiki versions before 1.39.13, 1.42.7, 1.43.2, and 1.44.0. Red Hat notes a weakness in how authentication is handled; De...
CVE-2025-6597 MediaWiki should not consider autocreation as login for the purposes of security reauthentication
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects MediaWiki: from before 1.39.13, 1.42.7, 1.43.2, 1.44.0...
Astra Linux – Vulnerability in Samba
A flaw was discovered in Samba. The smbd service daemon does not detect changes in group membership when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then reconnect...
CVE-2025-34269
Nagios Fusion versions prior to R2.1 contain a vulnerability due to the application not requiring re-authentication or session rotation when a user has enabled two-factor authentication 2FA. As a result, an adversary who has obtained a valid session could continue using the active session after t...
CVE-2025-34269
...
EUVD-2021-31869
Malicious code in bioql PyPI...
Malware in reauthentication-node-sdk
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Security update for samba
This update for samba fixes the following issues: CVE-2025-0620: smbd doesn't pick up group membership changes when re-authenticating an expired SMB session bsc1244136. Other bugfixes: net ad join fails with "Failed to join domain: failed to create kerberos keytab" bsc1238063. Patch Instructions:...
Malicious code in reauthentication-node-sdk (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72a2ebcf785b83a7356e194089e96e975e8618fac2aa00fc1c1f3ba097500ae4 Any computer that has this package installed or running should be considered...
MAL-2025-5823 Malicious code in reauthentication-node-sdk (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72a2ebcf785b83a7356e194089e96e975e8618fac2aa00fc1c1f3ba097500ae4 Any computer that has this package installed or running should be considered...
CVE-2025-0620
A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again...