CVE-2026-66139

OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...

DEBIAN-CVE-2026-66139

OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...

UBUNTU-CVE-2026-66139

OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...

CVE-2026-66139

OpenStack Zaqar

CVE-2026-66139

OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...

EUVD-2026-48477

OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...

CVE-2026-66139

OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...

CVE-2026-66139

OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...

SUSE CVE-2026-15789

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

ROS-20260724-73-0029

The vulnerability in dotnet10.0 relates to bypassing authentication using data that is assumed to be unchangeable. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

ROS-20260724-73-0022

The vulnerability in dotnet10.0 relates to bypassing authentication using data that is assumed to be unchangeable. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

PT-2026-64377

Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12 Description Authenticated users possessing the PUBLICLINK CREATE profile flag can trigger unauthorized decryption and persistent storage of any vault account password. This occurs due to missing AccountAcl chec...

PT-2026-64233

Name of the Vulnerable Software and Affected Versions OpenStack Zaqar versions prior to 22.0.1 Description An authentication bypass exists when a UUID is known, allowing unauthorized access via the EXTRA-SPEC header. Recommendations Update to a version newer than 22.0.0...

PT-2026-64319

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.83.0 commit 71a45ee Description An authentication bypass exists in the '/setup comm prefs' endpoint. This allows unauthenticated attackers to overwrite operator metadata, such as email, name, and company, after the...

Rockwell FactoryTalk Services Platform 6.60 Authentication Bypass (SD1786)

The version of Rockwell FactoryTalk Services Platform installed on the remote Windows host is 6.60. It is, therefore, affected by an authentication bypass vulnerability: - A vulnerability exists that allows an attacker to bypass JWT signature validation during Okta Web Authentication. The...

CVE-2026-15981

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mosamlvalidatesignature function performing a loose boolean check on the raw tri-state integer returned by PHP's opensslverify, causing a...

CVE-2026-63313

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...

CVE-2026-15981

CVE-2026-15981 is a critical (CVSS 9.8) unauthenticated authentication bypass in the miniOrange SAML 2.0 Single Sign On – SSO Login WordPress plugin (≤ 5.4.4). The root cause is a loose boolean check in mo_saml_validate_signature(): PHP's openssl_verify() returns -1 on internal error, which evalu...

EUVD-2026-48429

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mosamlvalidatesignature function performing a loose boolean check on the raw tri-state integer returned by PHP's opensslverify, causing a...

CVE-2026-63765

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation,...