BIT-GITEA-2026-96404 Gitea installer authentication bypass for existing accounts

When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...

BIT-GITEA-2026-73278 Gitea WebAuthn bypass during OAuth and OIDC sign-in

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during...

CURL-CVE-2026-87864 IMAP APPEND plus CRLF conversion command injection

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

DEBIAN-CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2026-94260

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting...

CVE-2026-107594

The File Upload to Order WordPress plugin, prior to version 1.1.4 , is vulnerable to unauthenticated arbitrary file deletion . The flaw occurs because the plugin fails to validate or confine a file path derived from attacker-controlled session data before performing a deletion action. Since this ...

UBUNTU-CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

Keycloak SSO Unauthorized Access

The vulnerability of the Single Sign-On SSO authentication mechanism of the Keycloak software for managing identity verification and access control is related to the fixation of the session at the final authorization points. Exploiting this vulnerability could allow a malicious actor to gain...

PT-2026-114325

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description Progress MOVEit Transfer contains an issue where sessions do not expire sufficiently, which could allow unauthorized access to active...

PT-2026-114364

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description When configured with ssl session cache shared:name:size without explicit ssl session ticket key file directives for automatic rotation of...

CVE-2026-105236: Improper Certificate Validation

Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server that serves several SNI nam...

PT-2026-114224

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.16.0 Description Deployments with AUTH BYPASS enabled trust the configured reverse-proxy identity header without verifying if the request originated from FR TRUSTED PROXIES. If the backend application port is...

Ubuntu: USN-8852-1 (CVE-2026-84471): OpenVPN vulnerabilities

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

PT-2026-114399

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd session register function where valid sessions are destroyed after ten seconds of inactivity when a client initiates another SessionSetup exchange. This occu...

CVE-2026-98420: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with...

PT-2026-114242

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL...

PT-2026-114207

Name of the Vulnerable Software and Affected Versions LDAP Account Manager LAM versions prior to 9.6 Description Installations using WebAuthn two-factor authentication fail to clear the challenge from the PHP session after the authentication response is processed. This allows a user who has alrea...

PT-2026-114163

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the...

PT-2026-114152

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description The shadow server dispatches input Protocol Data Units PDUs during the Confirm Active state before authentication is completed. This allows unauthenticated attackers to inject synthetic keyboar...

PT-2026-113918

An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service DoS. This issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS...