49106 matches found
CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
fastify versions = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches...
CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
fastify versions = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches...
EUVD-2026-70979
@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...
BIT-JOOMLA-2026-73337 Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2
Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-70403
XING CPTrans-ME-X contains a hard-coded password (CWE-259) that allows anyone who knows the credential to log in to the affected device. The vulnerability is rated CVSS 3.1: 9.8 CRITICAL (network vector, low complexity, no privileges or user interaction required) with high impact on confidentiali...
CVE-2026-70403
XING CPTrans-ME-X contains a Use of Hard-coded Password CWE-259. Anyone with the knowledge of the credential may log in to the affected device...
EUVD-2026-70810
MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local...
EUVD-2026-70812
MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables includin...
EUVD-2026-70798
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-75431
PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...
PT-2026-85496
Traefik versions = v3.7.0 and = v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress...
Linux Distros Unpatched Vulnerability : CVE-2026-14199
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key...
Flextype CMS 1.0.0-alpha.3 Authentication Bypass
Flextype CMS version 1.0.0-alpha.3 contains an authentication validation vulnerability in the API request-processing functionality. API endpoints may declare accesstoken as a required parameter, but the required-parameter validation only verifies that the corresponding key exists in the supplied...
The vulnerability of the validate_timestamp_and_nonce() function in the online training platform Open edX Platform allows attackers to circumvent security restrictions and gain unauthorized access to protected information.
The vulnerability of the validatetimestampandnonce function in the online training platform Open edX Platform relates to bypassing the authentication process. Exploiting this vulnerability could allow a malicious actor to circumvent security restrictions and gain unauthorized access to protected...
Linux Distros Unpatched Vulnerability : CVE-2026-85152
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a...
RHEL 9 : Satellite 6.19.4 Async Update (Important) (RHSA-2026:63385)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63385 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...
RHEL 9 : Satellite 6.18.9 Async Update (Important) (RHSA-2026:63386)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63386 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...
CVE-2026-85430
MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local...
CVE-2026-85428
MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables includin...