CVE-2026-111501

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Launch of phishing attacks...

CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass

CVE-2025-46018 – CSC Pay Mobile App Payment Authentication Bypass Summary A payment authentication bypass vulnerability was discovered in the CSC Pay Mobile App, affecting version 2.19.4. The flaw allowed an attacker to initiate a payment, disable Bluetooth at a specific point in the process, and...

CVE-2026-119568

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssldataaccept that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the...

CVE-2026-119561

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthnrequestresponse with...

CVE-2026-119559

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext implementation that always returns true, attackers can present a...

CVE-2026-119429

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...

CVE-2026-119425

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...

CVE-2026-119422

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119426

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or...

CVE-2026-119420

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive ...

CVE-2026-110972

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 242 in version 10.02.002...

CVE-2021-22911

CVE-2021-22911 Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1 The getPasswordPolicy method is vulnerable to NoSQL injection attacks and does not require authentication/authorization. It can be used to take over accounts by leaking password reset tokens. Taki...

CVE-2026-112374

FOSSBilling versions prior to 0.8.9 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the staff guest login endpoint (POST /api/guest/staff/login ). The root cause is that the checkGuestClientAuthentication() function only allowlists client_login and client_create, failing to provide ...

CVE-2026-112374 FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API

FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint POST /api/guest/staff/login that allows remote attackers to force authentication because checkGuestClientAuthentication only allowlists clientlogin and clientcreate, leaving stafflogin...

EUVD-2026-113897

FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint POST /api/guest/staff/login that allows remote attackers to force authentication because checkGuestClientAuthentication only allowlists clientlogin and clientcreate, leaving stafflogin...

CVE-2026-112374 FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API

FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint POST /api/guest/staff/login that allows remote attackers to force authentication because checkGuestClientAuthentication only allowlists clientlogin and clientcreate, leaving stafflogin...

httpd:2.4 security, bug fix, and enhancement update

An update is available for module.modmd, module.modhttp2, modmd, module.httpd, httpd, modhttp2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd package...

CVE-2026-110972

The Płatnik application is vulnerable to a use of client-side authentication (CWE-603) flaw. An attacker who gains access to any application instance connected to the backend server can bypass the login verification process to authenticate as an arbitrary user . This vulnerability has been addres...

EUVD-2026-113776

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 242 in version 10.02.002...

CVE-2026-110972 Use of Client-Side Authentication in Płatnik

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 242 in version 10.02.002...