CVE-2026-115967: Hamid Alinia Login with phone number: Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication…

Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78...

J-Web Management Tool Code Execution

The vulnerability in the web interface of the J-Web management tool for Juniper Networks Junos OS and Junos OS Evolved stems from flaws in the authentication process. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code with elevated privileges...

CVE-2026-111739: Unknown: The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0…

The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security AIOS WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own...

CVE-2026-119128: zitadel: ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows…

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser...

ALSA-2026:92869 Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve N...

PT-2026-130627

SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final login ajax action handler resolves a user and issues an authenticated session by matching the wp sslcare otp table on only the attacker-supplied phone a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146976)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146976 advisory. A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce...

PT-2026-132454

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL...

Linux Distros Unpatched Vulnerability : CVE-2026-116794

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's...

Linux Distros Unpatched Vulnerability : CVE-2026-115644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener fr...

ALSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service v...

ALSA-2026:92378 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service v...

Microsoft Entra Application Proxy Service Applicability Detector

Microsoft Entra application proxy contains an improper authentication vulnerability. This offline tool identifies explicitly named service records in local CSV or JSON inventories for applicability review; it does not determine current vulnerability status or remediation...

Octopus Deploy Octopus Server authorization issue vulnerability

In Octopus Deploy Octopus Server versions from 3.0.0 up to 2026.2.13487 and from 2026.3.0 up to 2026.3.15909, there is an authorization issue vulnerability. This vulnerability arises because proper access controls are not applied to LDAP user searches and LDAP group searches when the LDAP...

Progress Software WS_FTP Server authorization issue vulnerability

Security vulnerabilities exist in Progress Software WSFTP Server versions prior to 2024.0.6 and prior to 2025.0.3. These vulnerabilities stem from improper authentication and may allow unauthenticated remote attackers to access sensitive information, including administrator credentials...

Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: libcurl: Unauthorized...

PT-2026-130653

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute...

PT-2026-133259

Name of the Vulnerable Software and Affected Versions Silverstripe MFA versions prior to 6.0.0 Description In the CMS 5 password reset flow, a logged-in session can be issued after a user changes their password but before the configured multi-factor authentication challenge is completed. This...

CVE-2026-107059

An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication...

PT-2026-132390

An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication...