OESA-2026-3940 rabbitmq-server security update

RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fixes: RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improp...

Malicious code in @siriusbeyond/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695 Package @siriusbeyond/[email protected] registers both preinstall and postinstall lifecycle scripts that execute callback.js on every npm install...

MAL-2026-16320 Malicious code in @siriusbeyond/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695 Package @siriusbeyond/[email protected] registers both preinstall and postinstall lifecycle scripts that execute callback.js on every npm install...

Exploit for CVE-2024-31218

CVE-2024-31218 — Webhood / PocketBase Authentication Bypass La...

CVE-2026-86553

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID...

PT-2026-95973

Name of the Vulnerable Software and Affected Versions 0-Gaurav-0 nexus-mcp affected versions not specified Description Command injection is possible in the nexus reauth MCP tool within the file src/auth/browser.ts. The issue occurs when the url argument is passed to the child process.exec functio...

CVE-2026-94031: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function childprocess.exec of the file src/auth/browser.ts of the component nexusreauth MCP tool. The manipulation of the argument url results in command injection. The...

Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam

CVE-2026-33439 — OpenAM Pre-Auth RCE Pre-authentication Remot...

mod-auth-openidc:fuzz_state_cookie: Heap-buffer-overflow in libcrypto.so.3

Detailed Report: https://oss-fuzz.com/testcase?key=6578484257030144 Project: mod-auth-openidc Fuzzing Engine: afl Fuzz Target: fuzzstatecookie Job Type: aflasanmod-auth-openidc Platform Id: linux Crash Type: Heap-buffer-overflow READ 12 Crash Address: 0x78dceb4eee34 Crash State: libcrypto.so.3...

CVE-2026-93984

OpenPanel tracking API, through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 , fails to verify the client secret cryptographic hash before authorizing revenue events and bot filtering. An attacker possessing only a public client ID can supply arbitrary dummy secrets to inject forged revenue me...

mod-auth-openidc:fuzz_jwt: Heap-buffer-overflow in libcrypto.so.3

Detailed Report: https://oss-fuzz.com/testcase?key=4517809078730752 Project: mod-auth-openidc Fuzzing Engine: libFuzzer Fuzz Target: fuzzjwt Job Type: libfuzzerasanmod-auth-openidc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x7ada4c10b650 Crash State: libcrypto.so.3...

BIT-RCLONE-2026-88044 rclone: RC per-server auth-proxy bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...

click2shell

markdown Click2Shell — WordPress Pre-Auth RCE Chain PoC...

click2shell-poc

Click2Shell — WordPress Pre-Auth RCE Chain PoC Python proof...

SUSE CVE-2026-89970

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

CLEANSTART-2026-KJ02957 pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service

CVE-2026-66257 affects multiple packages. A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. See references for individual vulnerability details...

PT-2026-95847

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add auth"ensemble", ... request containing newline characters . When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

CVE-2026-93839 LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pdregister WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket...

CVE-2026-77386

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and...

CVE-2026-59163

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...