Cisco Secure Firewall ASA & FTD - Authentication Bypass

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should...

EUVD-2026-112580

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search...

CVE-2026-118426

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user can call the LDAP user search and LDAP group search functions. This issue is categorized as a Missing Authorization vulnerability (CWE-862) and carries a CVSS 4.0 base score of 5.3 (Medium...

SecuraBV-CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when successfully performing the bypass, and not perform any...

EUVD-2026-112491

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

EUVD-2026-113255

An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication...

PT-2026-132320

Name of the Vulnerable Software and Affected Versions OpenText Advanced Authentication Server versions 6.4.0.0 through 6.4.3.8 OpenText Advanced Authentication Server versions 6.5.0.0 through 6.5.0.10 OpenText Advanced Authentication Server versions 6.6.0.0 through 6.6.1.0 Description An...

WordPress Wild Apricot Login authorization issue vulnerability

WordPress Wild Apricot Login versions 1.0.18 and earlier contain an authorization issue vulnerability. This vulnerability arises because SSO email collisions fail to verify ownership matches for WordPress accounts; attackers can exploit WildApricot membership access to bypass authentication,...

CVE-2026-110245: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper…

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication...

CVE-2026-90867: Progress Software WS_FTP Server: Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and…

Improper access control in the Web Admin console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts...

CVE-2026-93680: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication...

CVE-2026-115708: Elastic Elastic Cloud Enterprise: Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to…

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack CAPEC-132...

ALSA-2026:92869 Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve N...

CVE-2026-85498: Red Hat: A flaw was found in polkit

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigge...

PT-2026-132835

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching sha2 password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the...

CVE-2026-107059

An issue in Nextcloud version 30390190 enables attackers to force victim users to logout of their accounts and switch to an attacker-controlled profile , effectively bypassing authentication. The provided documents do not specify the exact technical root cause, affected components, or available r...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146973)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146973 advisory. A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the en...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146976)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146976 advisory. A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce...

PT-2026-132327

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.6 Progress Software WS FTP Server versions prior to 2025.0.3 Description Improper authentication on Windows allows an unauthenticated remote attacker to access sensitive information,...

PT-2026-132330

Improper authentication in the Web Transfer Module of Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements...