Improper Authorization

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Improper Authorization in the deviceAuthorization plugin. An attacker can gain unauthorized access to a device or deny legitimate user sign-in by submitting ...

certificate_authority (0.1.0), crypt_guard (>=1.2.7, <=1.3.6) +11 more potentially affected by unknown CVE via pqcrypto-falcon (>=0.2.10, <=0.4.1)

pqcrypto-falcon CARGO version =0.2.10, =1.2.7, =0.1.0, =0.1.0, =0.12.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0165...

CVE-2024-6858: security-advisory-0103

In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN...

PT-2026-46307

Name of the Vulnerable Software and Affected Versions Better Auth versions 1.6.0 through 1.6.10 Description The deviceAuthorization plugin incorrectly treats any authenticated session as the owner of any pending device code. This occurs because the GET /device endpoint does not claim the row, and...

CVE-2026-43926: Observable Response Discrepancy

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint /client/reset-password-confirm/:hash is handled by a non-API controller and is not covered by FOSSBilling's rate limiter, which only applies to /api/ routes...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : nginx vulnerabilities (USN-8375-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8375-1 advisory. It was discovered that the nginx ngxmailsmtpmodule module incorrectly handled certain memory operations when doing SM...

CVE-2026-41860: Inadequate Encryption Strength

CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelpercreateasyncendpoint and sendhttpgetrequestsynchronous hard-code OpenSSL::SSL::VERIFYNONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH...

atila-vue (>=0.1.3, <=0.1.3.5), contrail (>=0.3.0, <=1.0.2) +11 more potentially affected by CVE-2026-6873 via django (3.0.0rc1)

django PYPI version 3.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - atila-vue =0.1.3, =0.3.0, =0.1.1, =0.0.1, =0.0.1, =0.2.7, =0.2.0, =2.0.0, =2.3.1, =2.3.9 Source cves: CVE-2026-6873 Source advisory:...

seed-auth-api (>=0.9.0, <=0.9.2), umap-project (>=0.8.0, <=0.8.3) potentially affected by CVE-2026-48587 via django (1.10.5)

django PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - seed-auth-api =0.9.0, =0.8.0, =0.8.3 Source cves: CVE-2026-48587 Source advisory: OSV:GHSA-923M-GV2P-W5QP...

cetk (>=0.0.4.dev0, <=0.0.5.dev0), django-custom-user-auth (>=1.0.1, <=1.0.4) +8 more potentially affected by CVE-2026-6873 via django (4.2.2)

django PYPI version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cetk =0.0.4.dev0, =1.0.1, =0.0.1, =2.0.0rc22, =2.0.0rc26 - kiwitcms 12.4.0 - pubsub-library 0.2.0 - signmeup 0.0.3 - voicebot-accounts 0.2.0 Source...

seed-auth-api (>=0.9.0, <=0.9.2), umap-project (>=0.8.0, <=0.8.3) potentially affected by CVE-2026-6873 via django (1.10.5)

django PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - seed-auth-api =0.9.0, =0.8.0, =0.8.3 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

seed-auth-api (>=0.9.0, <=0.9.2), umap-project (>=0.8.0, <=0.8.3) potentially affected by CVE-2026-8404 via django (1.10.5)

django PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - seed-auth-api =0.9.0, =0.8.0, =0.8.3 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

EUVD-2026-34068

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the apikey field in...

Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp

CVE-2025-32433 분석 포트폴리오 Erlang/OTP SSH 사전인증 원격 코드 실행 취약점 분석...

CVE-2026-50052

In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack request smuggling, which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and...

Fedora 44 : roundcubemail (2026-2b956d89d3)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2b956d89d3 advisory. Release 1.7.1 - Enigma: Support automatic public key lookup import using HKP v1 protocol 5314 - Managesieve: Fix error when a mail message contains...

CVE-2026-48726

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for FabAuthManager and KeycloakAuthManager did not actually reach the underlying revoketoken call, so the JWT remained accepted by the API server...

CVE-2026-10617 nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-10617

The CVE-2026-10617 entry describes a vulnerability in nextlevelbuilder GoClaw up to version 3.11.3, affecting the resolveAuth function in internal/http/auth.go of the Webhook Verification Handler. The issue results from a manipulation that leads to missing authentication, enabling remote exploita...

CVE-2026-3198

MLflow 3.9.0 with basic-auth "--app-name basic-auth" fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the "BEFOREREQUESTHANDLERS" dictionary in "mlflow/server/auth/init.py" does not include entries for "ListGatewaySecretInfos", "ListGatewayEndpoints",...