PT-2026-132835

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching sha2 password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the...

CVE-2026-90862: Progress Software WS_FTP Server: Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and…

Improper authentication in the Web Transfer Module of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements...

UBUNTU-CVE-2026-118264

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later...

CVE-2026-114230: Apache Software Foundation Apache Qpid Proton C: When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL…

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

Linux Distros Unpatched Vulnerability : CVE-2026-116794

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's...

PT-2026-133259

Name of the Vulnerable Software and Affected Versions Silverstripe MFA versions prior to 6.0.0 Description In the CMS 5 password reset flow, a logged-in session can be issued after a user changes their password but before the configured multi-factor authentication challenge is completed. This...

Wildfly software supply chain issue vulnerability

WildFly has a vulnerability related to its software supply chain. This vulnerability arises because the CSIv2 security interceptor accepts an ITTPrincipalName identity assertion in a service environment without validating any transport-layer authentication. As a result, remote attackers may bypas...

PT-2026-130653

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute...

PT-2026-132390

An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication...

PT-2026-133238

In token-exchange authenticated controllers, shopify app exposes shop context through helpers such as current shopify domain. Prior to the fix, current shopify domain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or...

CVE-2026-107059

An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication...

UBUNTU-CVE-2026-115644

Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. When operators isolate the admin REST API by explicitly configuring the "admin.listeners" property, REST...

Azure Kubernetes Configuration Service Applicability Detector

Azure Kubernetes Configuration Service contains a missing authentication vulnerability. This offline tool evaluates strict local CSV or JSON asset inventories for explicit service identifiers and reports applicability only; it does not probe targets or determine current vulnerability status...

CVE-2026-112255: OpenText Advanced Authentication Server: Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows…

Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix for...

CVE-2026-118030: Red Hat: A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and…

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An...

CVE-2026-118264

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later...

CVE-2026-118681

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path...

Progress Software WS_FTP Server authorization issue vulnerability

Security vulnerabilities exist in Progress Software WSFTP Server versions prior to 2024.0.6 and prior to 2025.0.3. These vulnerabilities stem from improper authentication and may allow unauthenticated remote attackers to access sensitive information, including administrator credentials...

Octopus Deploy Octopus Server authorization issue vulnerability

In Octopus Deploy Octopus Server versions from 3.0.0 up to 2026.2.13487 and from 2026.3.0 up to 2026.3.15909, there is an authorization issue vulnerability. This vulnerability arises because proper access controls are not applied to LDAP user searches and LDAP group searches when the LDAP...

WordPress Wild Apricot Login authorization issue vulnerability

WordPress Wild Apricot Login versions 1.0.18 and earlier contain an authorization issue vulnerability. This vulnerability arises because SSO email collisions fail to verify ownership matches for WordPress accounts; attackers can exploit WildApricot membership access to bypass authentication,...