CVE-2026-119426 phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or...

CVE-2026-119425 OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...

CVE-2026-119426

Versions of phpMyAdmin through 5.2.3 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is a CSRF token bypass occurring on non-AJAX POST requests sent to the /sql or /database/sql endpoints. A remote attacker can lure an authenticated victim into submitting a cro...

EUVD-2026-113805

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...

CVE-2026-119422 Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

EUVD-2026-113802

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119422 Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119422 Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...

CVE-2026-119422

Juspay Hyperswitch before version 1.128.0 is vulnerable to an authentication bypass in the Worldpayxml connector . The root cause is that the verify_webhook_source function always returns true without enforcing mTLS , allowing unauthenticated attackers to forge payment status updates. By providin...

CVE-2026-119420

The software Lago (versions through 1.55.0) is vulnerable to an authentication bypass via the acceptInvite GraphQL mutation. This vulnerability allows organization administrators to obtain session tokens for existing accounts without a password check. By inviting a victim's email and accepting th...

CVE-2026-119420 Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive ...

EUVD-2026-113800

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive ...

CVE-2026-119420 Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive ...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2026.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 26.0.0-IF004 and 24.0.1-IF010. These vulnerabilities have been also addressed in 24.0.0-IF009 and 25.0.0-IF007 Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determine...

CVE-2026-85268

A Cross-Site Scripting XSS CWE-79 vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID...

Next.JS-CVE-2025-29927

Next.js Vulnerability Scanner CVE-2025-29927 A security tool to detect and verify Next.js applications vulnerable to CVE-2025-29927 Authentication Bypass. Features 🎯 Accurate Next.js detection with multiple verification methods 🔍 Precise version comparison to identify vulnerable instances 🛡️...

CVE-2025-41646

CVE-2025-41646 - RevPi Webstatus = 2.4.5 Authentication Bypass Exploit Overview This is a Python3 exploit script for CVE-2025-41646 , an Authentication Bypass vulnerability affecting RevPi Webstatus = 2.4.5. Vulnerability Details: CVE ID : CVE-2025-41646 Affected Product : RevPi Webstatus = 2.4.5...

CVE-2024-9014

CVE-2024-9014 - pgAdmin 4 OAuth2 Authentication Bypass Exploit Tools This repository contains tools to check for and exploit the CVE-2024-9014 vulnerability in pgAdmin 4. The vulnerability allows an attacker to bypass OAuth2 authentication and access sensitive resources. Tools 1...

PoC_CVE-2025-54887

PoCCVE-2025-54887 This repository contains Proof-of-Concept PoC exploit for CVE-2025-54887. This is a vulnerability in ruby-jwe version = 1.1.0 where the authentication tag of encrypted JWEs can be brute forced, which may result in loss of confidentiality and provide ways to craft arbitrary JWEs...

CVE-2026-22110

The web server is vulnerable to a missing authentication check on POST and PUT requests. An unauthenticated attacker can exploit this to reboot the charger . Additionally, by brute-forcing the configid , an attacker can set the service password and subsequently modify any system setting. No speci...