CVE-2026-79938

Dell PowerProtect Cyber Recovery , versions prior to 20.3 , is affected by an Improper Authentication vulnerability. A low-privileged attacker with remote network access can exploit this flaw to achieve unauthorized access . The CVSS 3.1 score is 7.6 (HIGH) , with the primary impact on integrity ...

bmcweb

Server web OpenBMC Questo componente tenta di essere un server web embedded "fai tutto" per OpenBMC. Funzionalità Il server web implementa alcune interfacce distinte: Websocket di eventi DBus. Consente di registrarsi per ricevere modifiche a percorsi dbus specifici, proprietà, e invierà un evento...

CVE-2026-41940-POC

CVE-2026-41940 – PoC di Bypass dell'Autenticazione cPanel/WHM Questo repository contiene un proof-of-concept PoC per CVE-2026-41940, che dimostra un bypass dell'autenticazione in più passaggi in cPanel/WHM tramite iniezione CRLF e avvelenamento della sessione. Disclaimer: Questo codice è destinat...

CVE-2026-75325

DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/' parameters...

CVE-2026-73501

A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized acce...

EUVD-2026-66222

Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...

CVE-2026-47837

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

CVE-2026-47837

Spring Cloud Config is affected by a Missing Authentication for Critical Function vulnerability in the Server's /monitor endpoint. Webhook requests sent to this endpoint are not properly validated, meaning an authenticated user (Privileges Required: HIGH ) can send crafted webhook requests that c...

EUVD-2026-66638

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

CVE-2026-47837 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

CVE-2026-16599

A flaw was found in wget's FTP OPIE/S-KEY authentication functionality. A malicious FTP server or a network attacker can send a specially crafted OPIE challenge. This challenge contains a sequence number that, when processed by wget, can lead to an excessive number of cryptographic computations...

CVE-2026-81032

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...

CVE-2026-81029

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

EUVD-2026-66605

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer...

CVE-2026-81027

one-api (through version 0.6.10 ) contains an authorization bypass in its channel-pinning logic in middleware/auth.go. The software offers two ways to pin a request to a specific upstream channel: a suffix on the API key and a URL path parameter (channelid). Only the suffix path is gated behind a...

CVE-2026-74752

CVE-2026-74752 is a critical (CVSS 9.8) vulnerability in the Linux kernel's SCTP implementation. When cookie authentication is disabled, the COOKIE_ECHO handler restores fixed-size AUTH fields directly from peer-controlled cookie bytes without validating them against local backing arrays. A forge...

CVE-2026-74752 sctp: validate cookie AUTH state before use

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-74752 sctp: validate cookie AUTH state before use

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-79178

A flaw was found in Google Chrome's Web Authentication Passkeys & Security Keys component, related to incorrect authorization. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to bypass the web origin polic...