CVE-2026-115644

Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. When operators isolate the admin REST API by explicitly configuring the "admin.listeners" property, REST...

Keycloak race condition vulnerability

Keycloak has a race condition vulnerability. This issue arises because the HOTP authentication mechanism in the keycloak-services component divides its process into two separate steps when validating a one-time password and updating internal counters; these steps are not properly locked. As a...

OpenText Advanced Authentication Server trust management issue vulnerability

Vulnerabilities related to trust management exist in OpenText Advanced Authentication Server versions 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0. These vulnerabilities stem from the acceptance of excessive untrusted data alongside trusted data, potentially...

PT-2026-132482

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0 through 11.0.26,...

OpenText Advanced Authentication Server configuration error vulnerability

OpenText Advanced Authentication Server versions 6.4.0.0 through 6.4.3.x, 6.5.0.0 through 6.5.0.x, and 6.6.0.0 through 6.6.1.0 contain a configuration error vulnerability. This vulnerability stems from the use of insecure default configurations during resource initialization, potentially leading ...

Polkit buffer error vulnerability

Polkit contains a buffer error vulnerability. This vulnerability arises when processing input starting with an empty byte; an arithmetic error in the authentication proxy helper leads to an integer underflow in buffer length calculations. This results in an out-of-bounds memory read. Attackers ca...

PT-2026-133237

Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected...

Apache Qpid Proton C authorization issue vulnerability

Apache Qpid Proton C versions 0.40.0 and earlier contain an authorization issue vulnerability. This vulnerability arises because, when distributing SASL frames for authentication, AMQP frames that claim to be SASL frames are also sent, potentially allowing authentication bypass. Since no username...

CVE-2026-109516: guruteam Bot for Telegram on WooCommerce: The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account…

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permissioncallback = 'returntrue' and performs no Telegram...

CVE-2026-107059

Nextcloud version 30390190 is affected by a vulnerability in the AuthenticatorActivity component caused by the improper export of application components . This flaw allows a remote attacker to bypass security mechanisms, forcing users to log out and switch to an attacker-controlled profile. No sp...

Elastic Cloud Enterprise backlink vulnerability

Versions 1.0.0 through 3.8.5 and 4.0.0 through 4.2.0 of Elastic Cloud Enterprise contain a post-link vulnerability. This vulnerability stems from improper link resolution prior to file access; it is susceptible to symbolic link attacks and may lead to authentication bypass as well as unauthorized...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146973)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146973 advisory. A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the en...

Linux Distros Unpatched Vulnerability : CVE-2026-118264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146968)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146968 advisory. An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.1.9 (RHSA-2026:92057)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92057 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release ...

ArubaOS 10.4.x < 10.4.1.14 / 10.7.x < 10.7.2.7 / 10.8.x < 10.8.1.2 Multiple Vulnerabilities (HPESBNW05162)

The version of ArubaOS AOS-10 installed on the remote host is affected by multiple vulnerabilities as referenced in the HPESBNW05162 advisory: - Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted...

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve N...

PT-2026-132237

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication...

CVE-2026-90867: Progress Software WS_FTP Server: Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and…

Improper access control in the Web Admin console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts...

UBUNTU-CVE-2026-110952

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...