CVE-2026-79395

The Xiongmai IP Camera XM530 (firmware HMT.CM2005-v220608.1837 and earlier) is vulnerable to an improper authentication flaw in the Sofia IPC daemon . The vulnerability exists within the WS-Security (wsse:UsernameToken) verification routine, allowing remote attackers to bypass authentication by s...

CVE-2026-79394

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio fee...

Linux Distros Unpatched Vulnerability : CVE-2026-88018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with...

Linux Distros Unpatched Vulnerability : CVE-2026-88017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy drive...

openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21809-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21809-1 advisory. Update to version 3.21.1: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21801-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21801-1 advisory. - CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA certificates bsc1258543....

artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0

A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBETOPOLOGYV2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore, no credential...

auth v2.197.0

Auth - Authentication and User Management by Supabase Auth is a user management and authentication server written in Go that powers Supabase's features such as: Issuing JWTs Row Level Security with PostgREST User management Sign in with email, password, magic link, phone number Sign in with...

rclone: http backend forwards custom/auth headers to a different host on redirect

Vulnerability Details File: backend/http/http.go Lines: 285 client construction — no CheckRedirect, 505-510 addHeaders, writes configured secret headers onto every request, 533-534 / 700-701 / 782-785 f.httpClient.Doreq used by List/stat/download Root Cause The http backend lets a user attach...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the authentication process when the --auth-proxy option is enabled without also setting --auth-key. An attacker can gain unauthorized access by supplying any access key ID and signing...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the authentication process when the --auth-proxy option is enabled without also setting --auth-key. An attacker can gain unauthorized access by supplying any access key ID and signing...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the authentication process when the --auth-proxy option is enabled without also setting --auth-key. An attacker can gain unauthorized access by supplying any access key ID and signing...

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

Summary rclone serve s3's handler chain, when --auth-proxy is configured, is outermost first: authPairMiddleware - proxyAuthMiddleware - gofakes3's own SigV4-verifying handler. authPairMiddleware parses the accessKeyID straight out of the incoming request's own Authorization header entirely...

GHSA-XWWR-4H3P-R22C rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

Summary rclone serve s3's handler chain, when --auth-proxy is configured, is outermost first: authPairMiddleware - proxyAuthMiddleware - gofakes3's own SigV4-verifying handler. authPairMiddleware parses the accessKeyID straight out of the incoming request's own Authorization header entirely...

GHSA-P569-5GJG-9CMJ rclone: RC per-server auth-proxy bypass

Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...

rclone: RC per-server auth-proxy bypass

Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...

rclone: FTP cross-session auth-proxy backend confusion

Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...

GHSA-C476-6W5Q-JW77 rclone: FTP cross-session auth-proxy backend confusion

Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...

EUVD-2026-75174

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication...

NPM: n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

NPM: n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...