CVE-2026-112256

OpenText Advanced Authentication Server versions 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0 are vulnerable to a logon bypass due to the acceptance of extraneous untrusted data with trusted data (specifically, an attacker-controlled completed-methods list ). Thi...

EUVD-2026-113002

Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix for...

CVE-2026-112255

OpenText Advanced Authentication Server is vulnerable to an insecure default configuration issue (CWE-1188) affecting versions 6.4.0.0 through 6.4.3.x , 6.5.0.0 through 6.5.0.x , and 6.6.0.0 through 6.6.1.0 . The root cause is an insecure default allow-list that permits Excessive Allocation of re...

CVE-2026-42167

CVE-2026-42167: SQL Injection in ProFTPD modsql 📋 Executive Summary CVE-2026-42167 is a critical SQL injection vulnerability in ProFTPD's modsql module that allows authentication bypass , backdoor user injection , and remote code execution RCE. Attribute| Value ---|--- Type| SQL Injection CWE-89...

hikvision_CVE-2017-7921_auth_bypass_config_decryptor

hikvisionCVE-2017-7921authbypassconfigdecryptor This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921. https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ Description Hikvision IP Cameras Authentication Bypass...

EUVD-2026-113155

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication...

CVE-2026-93680

Langflow OSS versions 1.0.0 through 1.12.8 are vulnerable to an authentication bypass (CWE-287) that allows a remote attacker to bypass security restrictions. Specifically, versions 1.5.0 through 1.11.4 allow unauthenticated connections to the MCP SSE endpoint , enabling attackers to initialize M...

CVE-2026-93680 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication...

CVE-2026-115708

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack CAPEC-132...

EUVD-2026-113127

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication...

CVE-2026-110245

Langflow OSS versions 1.0.0 through 1.12.4 are vulnerable to improper authentication (CWE-287 ). This flaw could allow a remote attacker to obtain sensitive information. To remediate this vulnerability, IBM strongly recommends upgrading to version 1.12.5 . For users on affected versions, it is ad...

nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification

A flaw was found in Node.js TLS hostname verification. When a client connects using a non-canonical IPv4 hostname spelling for example 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1, tls.checkServerIdentity may fail to classify the host as an IP address, normalize it to a canonical form, and match...

Important: Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-109952

A flaw was found in FreeRDP. A remote attacker, acting as a malicious server or an on-path attacker, can exploit this flaw to cause information disclosure by intercepting user credentials in cleartext. Due to missing validation during connection negotiation, the client accepts unapproved security...

EUVD-2026-112921

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack CAPEC-132...

CVE-2026-115708 Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack CAPEC-132...

CVE-2026-115708

Elastic Cloud Enterprise (ECE) is vulnerable to an Improper Link Resolution Before File Access (CWE-59 ) flaw, which allows for a Symlink Attack (CAPEC-132 ). The root cause enables an attacker to achieve authentication bypass and perform unauthorized configuration changes on other deployments ho...

Critical: Red Hat Security Advisory: OpenJDK 25.0.5 Security Update for Portable Linux Builds

An update is now available for OpenJDK. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...

curl: Information disclosure due to uncleared proxy authentication state

A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of Proxy-Authorization headers to an incorrec...

curl: curl: Information disclosure via incorrect Digest authentication header reuse

A flaw was found in curl. When libcurl performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This...