CVE-2026-117635

A flaw was found in Gitea. The administrative application programming interface API does not properly enforce public-only restrictions on personal access tokens. An authenticated attacker possessing a restricted administrator token can bypass these limitations to perform unauthorized administrati...

CVE-2026-82067

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

WatchGuard Fireware OS authorization issue vulnerability

Security vulnerabilities exist in WatchGuard Fireware OS versions from 2025.1 up to and including 2026.4, as well as versions from 12.0 up to and including 12.12.4 and from 12.0 up to and including 12.5.22. These vulnerabilities stem from the FireCluster synchronization daemon lacking...

Sciener TTLock encryption issue vulnerability

Versions of Sciener TTLock prior to 9.8.260718 contain an encryption vulnerability stemming from a hard-coded static AES key. This may allow attackers within Bluetooth range to decrypt session keys transmitted during BLE pairing. By using the embedded defaultKey, they can recover persistent sessi...

EUVD-2026-95898

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user...

PT-2026-108963

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.x Description Nginx UI contains a cross-site request forgery CSRF flaw where the AuthRequired middleware accepts a browser-managed cookie named token as a valid API credential. Because management endpoints d...

CVE-2026-97404

A flaw was found in OpenStack Zaqar. An unauthenticated remote attacker who knows a target project's identifier can bypass authentication by sending an HTTP request containing an empty URL-Signature header to the Web Server Gateway Interface WSGI transport. Successful exploitation allows the...

CVE-2026-87681

An Access Control Bypass vulnerability exists in the Role-Based Access Control RBAC validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks...

EUVD-2026-94655

An Access Control Bypass vulnerability exists in the Role-Based Access Control RBAC validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks...

CVE-2026-87681

An Access Control Bypass vulnerability exists in the Role-Based Access Control RBAC validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks...

CVE-2026-87681

An Access Control Bypass vulnerability exists in the Role-Based Access Control RBAC validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks...

CVE-2026-87681

An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1 . The flaw occurs because the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks while processing specific mana...

CVE-2026-87681: Improper Privilege Management

An Access Control Bypass vulnerability exists in the Role-Based Access Control RBAC validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks...

PT-2026-107726

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 10.0.1 Description An access control bypass exists in the Role-Based Access Control RBAC validation engine. During the processing of specific management protocol operations, the RBAC engine incorrectly...

Access Control Bypass vulnerability in the RBAC validation engine of Brocade Fabric OS

| Summary: An Access Control Bypass vulnerability exists in the Role-Based Access Control RBAC validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permissi...

Rocky Linux 10.1 [CIQ] Security Update: keylime / keylime-base / keylime-registrar / keylime-selinux / etc (crlsa-2026_2225)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20262225 advisory. keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication CVE-2026-1709 Tenable has...

Rocky Linux 9 [CIQ] Security Update: keylime / keylime-base / keylime-registrar / keylime-selinux / etc (crlsa-2026_2224)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20262224 advisory. keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication CVE-2026-1709 Tenable has...

SUSE CVE-2026-76578

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...

PT-2026-96825

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5 Description The 'POST /login' endpoint in lightrag/api/lightrag server.py does not implement rate limiting, account lockout, delays, or counters for failed authentication attempts. This allows a network attacke...

CVE-2026-88895: Improper Authentication

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...