org.jenkins-ci.plugins:reverse-proxy-auth-plugin (>=1.3.3, <=1.6.3) potentially affected by CVE-2026-84662 via org.jenkins-ci.plugins:ldap (1.8)

org.jenkins-ci.plugins:ldap MAVEN version 1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:ldap and may be impacted: - org.jenkins-ci.plugins:reverse-proxy-auth-plugin =1.3.3, =1.6.3 Source cves: CVE-2026-84662 Source advisory...

CVE-2026-2688

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

BIT-MYSQL-CLIENT-2026-55854 MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In...

BIT-MARIADB-2026-55854 MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In...

CVE-2026-78586

Kibana (Elastic) is vulnerable to unbounded memory allocation (CWE-770) that can cause a denial of service. An authenticated user with low-level privileges can submit a specially crafted request causing Kibana to consume unbounded memory, rendering it unavailable to all users. Affected versions: ...

CVE-2026-84807 Kimai before 2.65.0 Authentication Bypass via Team Creation

Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...

Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access SMA 1000 series VPN appliances that have been exploited in zero-day attacks. The vulnerabilities, discovered internally by SonicWall's William Perry and Adam Babis, are listed below -...

openssl: AES-OCB IV Ignored on EVP_Cipher() Path

A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface EVPCipher will have their provided Initialization Vector IV silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the...

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout Research - Vedere Labs said it used Anthropic's Claude to port a working pre-authentication remote code execution RCE exploit from one WAGO programmable logic controller PLC to another, executing attacker-supplied ARM shellcode on live hardware. The exploit targetsCVE-2021-31886 , a...

Security update for dovecot22

This update for dovecot22 fixes the following issues: Security issues fixed: CVE-2026-27852: DoS by sending mail with bad header bsc1276799. CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return bsc1276802. CVE-2026-33605: managesieve-login: pre-auth crash bsc1276809...

SUSE-SU-2026:3919-1 Security update for dovecot22

This update for dovecot22 fixes the following issues: Security issues fixed: - CVE-2026-27852: DoS by sending mail with bad header bsc1276799. - CVE-2026-33604: SMTP smuggling via missing dot-stuffing after bare carriage return bsc1276802. - CVE-2026-33605: managesieve-login: pre-auth crash...

CVE-2026-84700 Pika Unauthenticated Replication Access via Internal Protobuf Port

PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...

EUVD-2026-69704

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized...

PT-2026-84843

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition CRD without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This...

CVE-2026-52832: Improper Limitation of a Pathname to a Restricted Directory

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...

CVE-2026-66786: Improper Control of Generation of Code

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition CRD without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This...

PT-2026-84756

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a js access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker c...

PT-2026-84722

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

PT-2026-84754

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description Self-managed instances using Auth Proxy authentication with identity caching enabled where sync ttl is greater than zero are susceptible to an authentication bypass. The issue occurs because...

MiracleLinux 8 : glib2-2.56.4-177.el8_10 (AXSA:2026-1730:14)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1730:14 advisory. glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal CVE-2026-58010 glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetym...