PT-2026-133557

Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Server-side request forgery...

PT-2026-133499

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn request response wit...

CVE-2026-119682: ManageEngine SharePoint Manager Plus: An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine…

An improper access control vulnerability exists in the multi-factor authentication MFA functionality of ManageEngine SharePoint Manager Plus SPMP. A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the...

CVE-2026-61737: huajian123 ng-antd-admin: ng-antd-admin is an Angular and NestJS administration system template

ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default JWT secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any use...

CVE-2025-49602

An issue was discovered in Keyfactor EJBCA 9 where a former administrator may retain access after being removed from their role. If a valid TLS session is active during removal, the system may cache authentication for longer than the configured maximum time (default: 30 seconds). This allows the ...

PT-2026-133682

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.0.14 through 4.0.14 Canonical LXD versions 5.0.10 through 5.0.10 Canonical LXD versions 5.21.8 through 5.21.8 Canonical LXD versions 6.9 through 6.9 Description Improper certificate validation in the HTTPS listener...

CVE-2026-61729: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, verifygraylogheader in backend/app/activeresponse/routes/graylog.py and verifyvelociraptorheader in backend/app/incidents/routes/incidentalert.py authenticate webhooks against...

PT-2026-133658

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the host session id query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding...

CVE-2026-48164: CollaboraOnline online: Collabora Online is a collaborative online office suite based on LibreOffice technology

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the hostsessionid query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding...

CVE-2025-49602

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time default: 30 seconds, which results in the former...

PT-2026-133639

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust...

CVE-2026-115829: Delinea Secret Server: In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by…

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only...

PT-2026-133637

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer. handle auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device...

CVE-2026-119703: xinnan-tech xiaozhi-esp32-server: xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that…

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer.handleauth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device...

PT-2026-133478

Name of the Vulnerable Software and Affected Versions OPNsense core versions 26.1.6 through 26.7.7 Description An authentication bypass exists in the captive portal roaming feature. Unauthenticated attackers on the same Layer-2 segment can hijack authorized client sessions by spoofing...

CVE-2026-119660: yincongcyincong MuseBot: MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default sessionkey 'musebotsessionkey'. Attackers can sign a MuseBot-session cookie carrying a userid to gain full administrative access,...

EUVD-2025-211227

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time default: 30 seconds, which results in the former...

phpMyAdmin -- Multiple vulnerabilities, no fix available

VulnCheck reports: Seven vulnerabilities in phpMyAdmin up to and including 5.2.3 were published on 2026-10-30. The most severe of them, an authentication bypass, is in the WebAuthn second factor: assertion signatures are never verified against the stored public keys, so an attacker who already ha...

RHEL 9 : tomcat (RHSA-2026:92870)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92870 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat:...

CVE-2026-119705: towfiqi serpbear: SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote…

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust...