Autorize

Autorize Autorize は、Burp Suite 用のオープンソースの自動認可および認証実施検出 拡張機能です。 アプリケーションセキュリティエンジニアやペネトレーションテスターが、Webアプリケーションにおける認可バイパス や認証の脆弱性 を大規模かつ最小限の手作業で特定するために設計されています。 Autorizeは、高権限ユーザー が生成したトラフィックを受動的に監視し、リクエストを自動的に低権限 または未認証 のコンテキストで再送信し、サーバーの応答を分析してアクセス制御が適切に実施されているかを判断します。...

PT-2026-107511

Update: Since the original post, 20 additional Langflow CVEs have been published, including several high- and critical-severity vulnerabilities affecting versions up to 1.12.2. The newly disclosed issues cover a range of impact areas, including remote code execution, command injection,...

VulnCheck KEV: CVE-2026-82329

JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges...

CVE-2026-76133 Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm

The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate...

CVE-2026-76133

Ebyte NE2-D11 (and related variant NA111-M ) uses a deprecated hashing algorithm in an authentication-related operation. When an attacker can manipulate or predict the authentication exchange, the weak cryptographic construction may reduce the assurance of the authentication mechanism and facilit...

CVE-2026-82329

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...

EUVD-2026-67861

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...

EUVD-2026-67294

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

PT-2026-83316

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.111.21 JFrog Artifactory versions prior to 7.117.28 JFrog Artifactory versions prior to 7.125.20 JFrog Artifactory versions prior to 7.133.29 JFrog Artifactory versions prior to 7.146.38 JFrog Artifactory...

PT-2026-82793

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

CVE-2026-73431 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

PT-2026-71094

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

EUVD-2026-55163

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem...

EUVD-2026-55114

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered...

CVE-2026-16731

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

CVE-2026-60007

CVE-2026-60007 affects Eclipse Milo versions 0.6.0 through 1.1.4, where username-token processing reveals distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures. This enables a network-accessible, on-path attacker who captures a victim’s Basic128Rsa15-encrypt...

EUVD-2026-52408

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

CVE-2025-15627 Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication

A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers o...

EUVD-2026-51846

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API...

EUVD-2026-51860

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...