PT-2026-77197

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

PT-2026-77202

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...

EUVD-2021-34863

An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Denial of Service via specially crafted series of HTTP...

VMware vCenter Server 8.0 < 8.0 U3k / 9.0.x < 9.0.2.0100 / 9.1.x < 9.1.0.0200 Authentication Bypass (VMSA-2026-0006)

The version of VMware vCenter Server installed on the remote host is 8.0 prior to 8.0 Update 3k, or 9.0.x prior to 9.0.2.0100, or 9.1.x prior to 9.1.0.0200. It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory: - VMware vCenter contains an authentication...

PT-2026-77275

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs...

PT-2026-77248

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

The vulnerability of the Screen Sharing service in Apple macOS operating systems allows a perpetrator to gain full control over the system.

The vulnerability of the Screen Sharing service in Apple macOS operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain full control over the system...

CVE-2021-43718

An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Denial of Service via specially crafted series of HTTP...

CVE-2026-15741

creationtimestamp| type| source ---|---|--- 2026-08-17 22:35:09+00:00| seen| https://bsky.app/profile/securitylab-jp.bsky.social/post/3mtcr64c5zk2n 2026-08-20 17:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtjqaefa4u2f...

CVE-2026-69146

creationtimestamp| type| source ---|---|--- 2026-08-17 22:35:05+00:00| published-proof-of-concept| https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5 2026-08-17 23:31:40+00:00| seen| https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a 2026-08-18 00:01:16+00:00|...

CVE-2026-65329

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1. An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic...

http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

Impact An issue in DigestAuthProvider.verify: Algorithm silently forced to MD5. The configured algorithm parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses...

package pkcs12: Authentication bypass in Decode functions

Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS12 files from untrusted sources and rely on the password for authentication can be tricke...

Important: Red Hat Security Advisory: libssh security update

An update for libssh is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

libssh: libssh: authentication bypass via missing GSSAPI principal check

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users...

CVE-2026-65329

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1. An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic...

CVE-2026-65329

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1. An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic...

CVE-2026-45791

In Dokploy before 0.29.6, the user.update procedure updates account.password without deleting other rows from the session table, so a compromised better-auth.session_token session remains valid for up to three days after a password change. This allows continued access to the account despite a cre...

CVE-2026-75479

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full repor...

CVE-2026-75110

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTHENABLED=true but the undocumented, defaultless INTERNALSERVICESECRET environment variable is unset, the isinternalrequest check in src/memos/api/middleware/auth.py fails open:...