CVE-2026-76207

phpMyFAQ before 4.1.7 issues remember-me cookies before 2FA verification, allowing attackers with valid credentials to skip the 2FA challenge and replay the cookie for full authenticated access. CVSS 8.1 HIGH. No in-the-wild exploitation reported. Upgrade to 4.1.7; advisory at https://github.com/...

curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication

A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the...

CVE-2026-67363

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...

CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attack...

CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attack...

CVE-2026-67364

Balbooa Forms for Joomla (versions

CVE-2026-67363 Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...

EUVD-2026-62396

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...

mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

SummaryGlances's REST API server includes a documented safety check intended to guarantee that corscredentials=True can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality corsorigins == "" instead o...

hass-auth-synology (>=0.4.13, <=0.4.28), homeassistant-stubs (2022.12.9) potentially affected by CVE-2026-64825 via homeassistant (2022.12.9)

homeassistant PYPI version 2022.12.9 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - hass-auth-synology =0.4.13, =0.4.28 - homeassistant-stubs 2022.12.9 Source cves: CVE-2026-64825 Source advisory: OSV:PYSEC-2026-36...

Security update for open-iscsi

This update for open-iscsi fixes the following issues: CVE-2026-44943: remote file-write as root via discovery bsc1268353. CVE-2026-44944: iscsiuio control-socket auth bypass bsc1268352. Changes for open-iscsi: Update to version 2.1.12.suse+0.8f77cf16: Preparing for version 2.1.12 536...

SUSE-SU-2026:3647-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: - CVE-2026-44943: remote file-write as root via discovery bsc1268353. - CVE-2026-44944: iscsiuio control-socket auth bypass bsc1268352. Changes for open-iscsi: - Update to version 2.1.12.suse+0.8f77cf16: Preparing for version 2.1.12 536...

D-Link DIR-300 & DIR-320 & DIR-615 Auth Bypass

Module exploits authentication bypass vulnerability in D-Link DIR-300, DIR-320, DIR-615 revD devices. It is possible to access administration panel without providing password. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-320 & DIR-615 Auth Bypass""" import re from kittysploit...

Mikrotik WinBox Auth Bypass - Creds Disclosure

Module bypass authentication through WinBox service in Mikrotik devices versions from 6.29 release date: 2015/28/05 to 6.42 release date 2018/04/20 and retrieves administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Mikrotik WinBox Auth Bypass - Creds Disclosure""" import re fr...

PT-2026-78777

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with the schedule search capability can configure PD...

PT-2026-78352

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.2 Description An issue exists where the 'stripeCharges' and 'payAuthorize' endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without...

PT-2026-78509

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare wazuh versions in src/shared/version op.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy but does not...

Oracle Linux 9 : curl (ELSA-2026-55439)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55439 advisory. - fix HTTP Negotiate connection reuse auth bypass CVE-2026-1965 - fix OAuth2 bearer token leak via redirect and netrc CVE-2026-3783 - fix SSH host key...

PT-2026-78487

Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.11 Description The login.regenerate2FASecret task fails to verify if a user is authorized, checking only for the existence of a pending-session user. An attacker who has obtained a victim's password can...