EUVD-2026-112679

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigge...

BIT-TOMCAT-2026-101296 Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0 through 11.0.26,...

BIT-RCLONE-2026-116193 Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

BIT-NODE-2026-106072

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1. tls.checkServerIdentity did not classify these hosts as IP...

BIT-OPENBAO-2026-115362 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL...

Security update for rust-keylime

This update for rust-keylime fixes the following issue: CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers bsc1287921 CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification bsc1287921...

SUSE-SU-2026:4931-1 Security update for rust-keylime

This update for rust-keylime fixes the following issue: - CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers bsc1287921 - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification bsc128792...

Security update for rust-keylime

This update for rust-keylime fixes the following issue: CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers bsc1287921 CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification bsc1287921...

SUSE-SU-2026:4930-1 Security update for rust-keylime

This update for rust-keylime fixes the following issue: - CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers bsc1287921 - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification bsc128792...

SUSE-SU-2026:4927-1 Security update for libapr1, libtcnative-1-0, tomcat

This update for libapr1, libtcnative-1-0, tomcat fixes the following issues: - CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore bsc1282631. - CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure bsc1286502. - CVE-2026-7404...

Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift , is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco...

Waline Login Accepts A Non-string Email As A Match-all MongoDB Query

Summary The login endpoint POST /api/token reads the "email" field from the request body without checking its type and passes it straight into the MongoDB storage query. When "email" is not a string for example a JSON object such as "$ne": null, the MongoDB storage adapter's parseWhere silently...

Strengthening API and MCP Security Through Token Risk Detection with Thales Imperva API Security

Security teams can now investigate six token risks directly at the endpoint level, making it easier to prioritize findings and take action across their API estate. APIs depend on tokens to authenticate requests and control access. But weak signing algorithms, excessive token lifetimes, exposed...

CVE-2026-117859

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an...

CVE-2026-118030

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An...

Authentication Bypass

Better Auth is vulnerable to authentication bypass. The vulnerability is due to overlapping stored identifiers under specific Magic Link and OAuth configuration settings, which allows an unauthenticated attacker to exploit the OAuth sign-in flow to obtain a valid session for an existing user or...

EUVD-2026-112640

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An...

CVE-2026-118030

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An...

EUVD-2026-112639

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an...

CVE-2026-118174

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as...