CVE-2026-75825

ZohoCorp ManageEngine OpManager versions 12.8.710 and below are affected by an Authentication Bypass vulnerability when the Application Manager Plugin is enabled. Exploitation of this flaw could allow an attacker to bypass security controls. No specific root cause, exploit details, or remediation...

EUVD-2026-85271

ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability...

CVE-2026-86248

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

DEBIAN-CVE-2026-86248

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

DEBIAN-CVE-2026-76183

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...

CVE-2026-76183

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...

CVE-2020-6287

CVE-2020-6287 SAP NetWeaver AS JAVA（LM Configuration Wizard）認証バイパス（シンプルなJavaユーザーと管理者Javaユーザーの作成） SAP NetWeaverは、SAPの統合テクノロジープラットフォームであり、SAP Business Suite以降のすべてのSAPアプリケーションの技術基盤です。SAP NetWeaverは、サービス指向のアプリケーションおよび統合プラットフォームであり、SAPアプリケーションの開発・実行環境を提供します。また、カスタム開発や他のアプリケーション・システムとの統合にも使用できます。SAP...

CVE-2025-64459

CTF チャレンジ: Django ORM インジェクション CVE-2025-64459 カテゴリ: Webセキュリティ 難易度: 中級 脆弱性: CVE-2025-64459 - Django ORM フィルターインジェクション 📝 説明 私たちは管理パネル付きの安全なグッズショップを構築しました。認証をバイパスして、非公開の管理者メモを見つけられますか？ URL: http://YOURSERVER:6008 🚀 デプロイ root@kitploit: cd webdjangocve docker-compose up --build -d 🎯 エクスプロイト...

CVE-2025-26198

CVE-2025-26198 - SQLインジェクションのデモンストレーション ENSIMAG 学術プロジェクト - セキュリティ3A 著者: Wail Yacoubi, Mohammed-Yassine Akhmari 日付: 2026年1月 警告 このコードは教育目的で意図的に脆弱にしています。 絶対に本番環境にデプロイしないでください。 説明 CVE-2025-26198の再現: CloudClassroom-PHP-Project v1.0における重大なSQLインジェクション。 CVEの特徴: 識別子: CVE-2025-26198 CVSSスコア: 9.8/10 重大 タイプ:...

EUVD-2026-85234

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

CVE-2026-86248

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

CVE-2026-86248 Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

CVE-2026-86248

Apache Tomcat is vulnerable to a flaw where CLIENT_CERT authentication does not fail as expected in specific scenarios even when soft fail is disabled. This was caused by an incomplete fix for CVE-2026-34500 , where OCSP checks sometimes soft-fail with FFM. This issue affects versions 11.0.0-M14 ...

CVE-2026-96456

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

EUVD-2026-85225

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...

CVE-2026-76183 Apache Tomcat: Bypass of security constraints for WebSocket endpoints

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...

CVE-2026-76183

Apache Tomcat is vulnerable to an authentication bypass by alternate name. The root cause is that request paths were incorrectly parsed as endpoint templates, which allowed attackers to bypass security constraints for any WebSocket endpoint . This issue affects several versions, including 11.0.0-...

CVE-2026-76183

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...

CVE-2026-96445

A flaw exists in the Conditional OTP authenticator of Keycloak , an identity and access management solution. The system improperly evaluates specific HTTP headers to decide whether to skip a one-time password (OTP) without verifying if those headers originate from a trusted source . Consequently,...