CVE-2026-91039: Authentication Bypass by Spoofing

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in...

CVE-2026-54460: Missing Authentication for Critical Function

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and...

PT-2026-95105

Name of the Vulnerable Software and Affected Versions Caddy Proxy Manager versions prior to 1.5.1 Description Caddy Proxy Manager allows unauthenticated remote actors to create active accounts with the user role without administrator approval. This occurs because email and password...

Rclone 1.64.x < 1.75.1 FTP Auth-Proxy Cross-Session Backend Confusion (CVE-2026-88017)

The version of Rclone installed on the remote host is 1.64.x prior to 1.75.1. It is, therefore, affected by a cross-session backend confusion vulnerability: - The FTP auth-proxy driver stores one obscured password per username in a server-wide map and does not bind the credential or the returned...

CVE-2026-54907: Initialization of a Resource with an Insecure Default

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the...

CVE-2026-54239: Insufficient Verification of Data Authenticity

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt and WPE\FaustWP\Auth\decrypt in...

PT-2026-94578

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds read exists in the nvmet auth negotiate function. The nvmet execute auth send function allocates a DH-HMAC-CHAP message buffer using a host-supplied transfer length ...

PT-2026-95005

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 3.0.8 through 3.0.11 Description In the auth interceptor, the functions processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but fail to a...

PT-2026-95090

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.1.1 Description An authentication bypass exists where the endpoint "POST /api/auth/passkeys" accepts a userId and a passkey without requiring an authenticated session. The system fails to call...

tomcat security update

1:9.0.120-1 - Resolves: RHEL-192806 HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-219561 Security constraint bypass via improper URL encoding in rewrite valve CVE-2026-59083 - Resolves: RHEL-219581 Insufficient documentation for EncryptInterceptor may lead to insecure...

Debian dsa-6504 : libapache2-mod-auth-openidc - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6504 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6504-1 [email protected] https://www.debian.org/security/ Moritz...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: coredns (UTSA-2026-109796)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109796 advisory. CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. F...

RHEL 8 : tomcat (RHSA-2026:68680)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68680 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat-coyote: Apache...

Rclone 1.70.x < 1.75.1 RC Per-Server Auth-Proxy Bypass (CVE-2026-88044)

The version of Rclone installed on the remote host is 1.70.x prior to 1.75.1. It is, therefore, affected by an authentication bypass vulnerability: - The serve/start remote control method accepts protocol options in a per-server proxyOpt object, but the FTP and S3 server constructors decide wheth...

RHEL 9 : tomcat (RHSA-2026:68679)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68679 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Tomcat: Apache...

Siemens Teamcenter 2412.x < 2412.0013 / 2506.x < 2506.0010 / 2512.x < 2512.2607 / 2606.x < 2606.2607 XSS (SSA-157465)

The version of Siemens Teamcenter installed on the remote host is 2412.x prior to 2412.0013, or 2506.x prior to 2506.0010, or 2512.x prior to 2512.2607, or 2606.x prior to 2606.2607. It is, therefore, affected by a reflected cross-site scripting vulnerability. Affected applications do not properl...

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-41293...

CVE-2026-92578 WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash

WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest and encryptPasswordVerify. Attackers who obtain the stored users.password hash value can...

CVE-2026-92805

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

CVE-2026-75513

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary...