CVE-2026-65098

NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering...

PT-2026-81514

Name of the Vulnerable Software and Affected Versions NVIDIA NemoClaw for Linux affected versions not specified Description A flaw in the remote-access helper workflow allows for weak authentication. This issue could enable an attacker to achieve remote code execution, disclose sensitive...

Microsoft SharePoint Weak Authentication Vulnerability

Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-68067 Mira Hormone Monitor, Mira Android App Weak Authentication

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and...

CVE-2026-68067

The CVE concerns Mira Hormone Monitor / Mira Android App with a weak authentication issue in the cloud login API. The login endpoint accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. Attack scenario: ...

CVE-2026-59135

Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally...

CVE-2026-59135

Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally...

EUVD-2026-56313

Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally...

Microsoft Windows Search Component Information Disclosure Vulnerability

Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally...

PT-2026-70414

Name of the Vulnerable Software and Affected Versions Microsoft Windows Search Component affected versions not specified Description Weak authentication in the Microsoft Windows Search Component allows an authorized attacker to disclose sensitive information locally, which can affect the system...

(Pwn2Own) Microsoft Exchange Capture-Replay Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Microsoft Exchange. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of authentication requests. The issue results from using an alternative,...

CVE-2026-47882

CVE-2026-47882 affects Spring Tools for Eclipse (5.2.0 and earlier) where Spring Tools DevTools remote-restart uploads authenticate with a shared secret generated by a non-cryptographic PRNG. Root cause: secret generation relies on non-cryptographic randomness, weakening authenticity of remote-re...

CVE-2026-55040

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-44211

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network...

Microsoft SharePoint Server Security Feature Bypass Vulnerability

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-56083

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.80 Description The /api/settings/database endpoint allows for full database export and import without sufficient authentication. The endpoint is protected by the ALWAYS PROTECTED middleware, which only validates a...

EUVD-2026-39925

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access...

CVE-2026-31928

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access...

CVE-2026-31928

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access...

CVE-2026-31928

The CVE-2026-31928 entry concerns DMP-5000 devices shipped with a default administrative web account and weak authentication controls that are not required to be changed during initial configuration or operation, enabling full system access if exploited. The issue is tied to hard-coded/default cr...