Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration

A flaw was found in Apache Tomcat where OCSP-based certificate validation may incorrectly soft-fail during CLIENTCERT authentication, even when soft-fail is disabled, under certain FFM-related execution paths. This can result in client certificates being accepted despite failed or unverifiable...

CVE-2026-15063

The CVE-2026-15063 affects the gorch service in the trustyai-service-operator. The issue is that, even with authentication enabled, gorch exposes unproxied orchestrator and detector metrics ports, reachable from any pod on the cluster network. This bypasses kube-rbac-proxy authentication, enablin...

CVE-2026-15063

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing th...

Exploit for Improper Authentication in Phpmyadmin

phpMyAdmin-CVE-2018-12613 1. 취약점 요약 | 항목 | 내용 | |---|---|...

CVE-2026-14495

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because dologin\s::rrand seeds the Mersenne Twister with mtsranddouble microtime 1000000 — discarding the integer-second...

CVE-2026-14495 DoLogin Security <= 4.3 - Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because dologin\s::rrand seeds the Mersenne Twister with mtsranddouble microtime 1000000 — discarding the integer-second...

EUVD-2026-42167

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because dologin\s::rrand seeds the Mersenne Twister with mtsranddouble microtime 1000000 — discarding the integer-second...

Improper Following of Specification by Caller

Overview Affected versions of this package are vulnerable to Improper Following of Specification by Caller due to the GSSAPIStrictAcceptorCheck process when the server operates in a Windows Active Directory environment. An attacker can bypass intended authentication checks by exploiting this...

PT-2026-56572

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.0.7 MOVEit Transfer versions 2025.1.0 through 2025.1.2 Description A limited authentication bypass by spoofing exists within the HTTPS module of the software. Recommendations Update to version 2025.0.7 or...

gstreamer1 -- multiple vulnerabilities

The GStreamer project reports: Multiple security issues were identified and fixed in the GStreamer framework. GStreamer-SA-2026-0044: Out-of-bounds read in RTP CELT audio depayloader GStreamer-SA-2026-0049: Heap buffer overflow in MPEG-4 Video parser GStreamer-SA-2026-0050: Heap buffer overflow i...

traefik -- Multiple vulnerabilities

The traefik project releases a new version addressing multiple vulnerabilities: GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware GHSA-42cj-m3vj-89wv CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass GHSA-qq9q-x9w4-chhj Gateway API...

VulnCheck KEV: CVE-2026-4631

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH...

PT-2026-56583

Name of the Vulnerable Software and Affected Versions NATS Server versions prior to 2.14.3 NATS Server versions prior to 2.12.12 Description A flaw exists where a client can be registered as the configured no auth user via a parser path triggered when the initial client operation is not CONNECT...

RockyLinux 10 : nodejs22 (RLSA-2026:35842)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35842 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

BeyondTrust Remote Support (RS) < 25.3.3 Multiple Vulnerabilities (BT26-03)

The version of BeyondTrust Remote Support RS running on the remote host is prior to 25.3.3. It is, therefore, affected by multiple vulnerabilities, including: - A critical pre-authentication vulnerability in the authentication subsystem. Improper validation of authentication data may allow a...

Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, or 12.1.x. It is, therefore, affected by a vulnerability. An authentication bypass vulnerability in Large Scale VPN LSVPN functionality of Palo Alto Networks PAN-OS software allo...

CVE-2026-37270

Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and the presence of hard-coded credentials in the firmware...

CVE-2026-59704

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generatio...

CVE-2026-54602

CVE-2026-54602 — FastGPT : A cross-team information disclosure via GET /api/core/ai/record/getRecord existed prior to version 4.15.0. The endpoint authenticated users but loaded LLM request/response traces by requestId without team scoping, allowing any authenticated user to read another team’s p...

CVE-2026-49229 Actual: Disabled OpenID users keep access through existing session tokens

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row...