PT-2026-84754

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description Self-managed instances using Auth Proxy authentication with identity caching enabled where sync ttl is greater than zero are susceptible to an authentication bypass. The issue occurs because...

Session takeover via Auth Proxy cache key collision

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

MiracleLinux 8 : glib2-2.56.4-177.el8_10 (AXSA:2026-1730:14)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1730:14 advisory. glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal CVE-2026-58010 glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetym...

CVE-2026-14199: Authentication Bypass by Spoofing

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

PT-2026-84652

Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description A flaw exists where the software incorrectly reuses an HTTP connection setup for a specific hostname when using Negotiate authentication, specifically when the initial request is made with...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 — Marimo Pre-Auth RCE via Terminal WebSocket...

Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

A flaw in the challenge handling for app-based multi-factor authentication allows the second factor to be bypassed. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled...

CVE-2026-73775 Authenticated Sensitive Information Disclosure Vulnerabilities in AOS-CX

Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by...

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

Description Summary parsemultipartformdata httputil.py:34 calls data.splitb"--"+boundary+b"\r\n" before the maxparts check :35. A 600KB body with 100k parts creates a 100k-element transient list first, then rejects transient memory amplification each split element is a copy. Pre-auth HTTP DoS. Ro...

GHSA-8423-8FGW-73VQ tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

Description Summary parsemultipartformdata httputil.py:34 calls data.splitb"--"+boundary+b"\r\n" before the maxparts check :35. A 600KB body with 100k parts creates a 100k-element transient list first, then rejects transient memory amplification each split element is a copy. Pre-auth HTTP DoS. Ro...

CVE-2020-10965

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:01+00:00| seen| https://t.me/hackingAttack/95929 2026-09-01 20:01:01+00:00| seen| https://t.me/hackingAttack/95931 2026-09-02 01:01:21+00:00| seen| https://t.me/hackingAttack/95931 2026-09-02 01:01:22+00:00| seen|...

CVE-2026-78606 Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Where two authenticated principals originating from different authentication realms share the same username value...

NPM: MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

NPM: MySQL2: Auth Plugin Downgrade to mysqlclearpassword Leaks Plaintext Credentials vulnerability discovered by ? in WordPress Npm mysql2 versions 3.22.0...

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

Summary A rogue MySQL server or MITM can force mysql2 to send credentials in plaintext by requesting an auth switch to mysqlclearpassword. The driver complies without verifying that TLS is active. Details mysqlclearpassword is registered as a default standard plugin in lib/commands/authswitch.js...

GHSA-3F6P-5WW8-9RCR MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

Summary A rogue MySQL server or MITM can force mysql2 to send credentials in plaintext by requesting an auth switch to mysqlclearpassword. The driver complies without verifying that TLS is active. Details mysqlclearpassword is registered as a default standard plugin in lib/commands/authswitch.js...

AZL-98496 CVE-2026-74994 affecting package erlang for versions less than 26.2.5.21-6

The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...

CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

UBUNTU-CVE-2026-74994

The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...

Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.7.1. CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775. Patch Instructions: To install this SUSE update use the SUSE recommended installatio...

SUSE-SU-2026:3914-1 Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.7.1. - CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775...