CVE-2026-115708 Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack CAPEC-132...

CVE-2026-115708

Elastic Cloud Enterprise (ECE) is vulnerable to an Improper Link Resolution Before File Access (CWE-59 ) flaw, which allows for a Symlink Attack (CAPEC-132 ). The root cause enables an attacker to achieve authentication bypass and perform unauthorized configuration changes on other deployments ho...

Critical: Red Hat Security Advisory: OpenJDK 25.0.5 Security Update for Portable Linux Builds

An update is now available for OpenJDK. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...

Important: Red Hat Security Advisory: curl security, bug fix, and enhancement update

An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

curl: Information disclosure due to uncleared proxy authentication state

A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of Proxy-Authorization headers to an incorrec...

curl: curl: Information disclosure via incorrect Digest authentication header reuse

A flaw was found in curl. When libcurl performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This...

Critical: Red Hat Security Advisory: OpenJDK 21.0.13 Security Update for Portable Linux Builds

An update is now available for OpenJDK. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...

Gitmails

Development - IMPORTANT This Gitmails version is no longer maintained. Check out the Gitmails Shell port if you want to use a version that is maintained and, hopefully, developed. If you do not want to use the shell port and prefer the Python version, feel free to fork Gitmails and direct it to...

RLSA-2026:88347 Important: java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fixes: JDK: Enhance PKCS5 padding CVE-2026-83374 JDK: Enhance TLS certificate handling CVE-2026-83376 JDK: Improve C2 loop transformations CVE-2026-83378 JDK: Enhance...

CVE-2026-115967

Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78...

CVE-2026-115962

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...

CVE-2026-114230

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

CVE-2026-115962

The myCred WordPress plugin (versions through 4.0.1 ) is vulnerable to an Authentication Bypass by Spoofing vulnerability. This flaw allows for Identity Spoofing , where an attacker may bypass authentication mechanisms. While the vulnerability is identified as CWE-290 , the provided documents do ...

CVE-2026-115962 WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...

EUVD-2026-112736

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...

EUVD-2026-112729

Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78...

CVE-2026-115967

The Hamid Alinia Login with phone number (login-with-phone-number) plugin for WordPress is vulnerable to a Weak Authentication vulnerability (CWE-1390) in versions up to and including 1.8.78 . This flaw allows for Authentication Abuse , potentially leading to unauthorized access. The impact inclu...

CVE-2026-115967 WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability

Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell CVE-2026-109618 & CVE-2026-109619 — Pre-Auth RCE...

CVE-2026-41940-cPanel-Auth-Bypass-Exploit

CVE-2026-41940: cPanel/WHM Authentication Bypass Analysis Vulnerability Overview CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM affecting all currently supported versions. It allows an unauthenticated attacker to bypass authentication and gain root-level access W...