PT-2026-105752

These are all security issues fixed in the python313-social-auth-app-django-5.9.0-1.2 package on the GA media of openSUSE Tumbleweed...

PT-2026-104550

Name of the Vulnerable Software and Affected Versions Burst Statistics – Simple WordPress Analytics Google Analytics Alternative versions prior to 3.7.2 Description Improper authentication allows for account persistence. The maybe load shared dashboard handler issues a genuine WordPress session...

Incorrect Authorization

Overview langgraph-sdk is a SDK for interacting with LangGraph API Affected versions of this package are vulnerable to Incorrect Authorization via the ResourceOn.call method in langgraphsdk/auth/init.py, where custom authorization handlers registered with resource-specific decorators fail to...

CVE-2026-104873

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

CVE-2026-61373 Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-61373 Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-97637

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

CVE-2026-97637 JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

CVE-2026-97637

The JSON API Auth plugin for WordPress (versions up to and including 3.1.2 ) is vulnerable to an Authentication Bypass via cached session cookie disclosure. The root cause is that the required PI-Media/json-api parent plugin caches controller dispatch results using only the URI and query string, ...

EUVD-2026-91259

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

CVE-2026-97637 JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

WordPress JSON API Auth plugin <= 3.1.2 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Chi Trung Huynh in WordPress Plugin JSON API Auth versions = 3.1.2...

Atlassian Jira Seraph - Authentication Bypass

Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also...

Adobe Commerce/Magento - Customer Session Identity Switch

Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction. id: CVE-2026-71362 info: name: Adobe Commerce/Magento - Customer Session Identity Switch...

ThinVNC 1.0b1 - Authentication Bypass

ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a...

GitLab - Account Takeover via Password Reset

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to a...

PT-2026-104152

Name of the Vulnerable Software and Affected Versions JSON API Auth plugin for WordPress versions prior to 3.1.3 Description An authentication bypass exists due to cached session cookie disclosure. The PI-Media/json-api parent plugin caches controller dispatch results in transients based only on...

The vulnerability in the oauth2UpdateAvatarIfNeed() function of the routers/web/auth/oauth.go file in the Git repository management system Gitea allows a hacker to disclose protected information.

The vulnerability of the oauth2UpdateAvatarIfNeed function in the routers/web/auth/oauth.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

CVE-2026-97637: Improper Authentication

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

The vulnerability of the CheckAuthToken() function in the services/auth/auth_token.go file of the Git repository management system Gitea allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the CheckAuthToken function in the services/auth/authtoken.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the...