CVE-2026-119128: zitadel: ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows…

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser...

PT-2026-130627

SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final login ajax action handler resolves a user and issues an authenticated session by matching the wp sslcare otp table on only the attacker-supplied phone a...

PT-2026-132454

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL...

Linux Distros Unpatched Vulnerability : CVE-2026-115644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener fr...

Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: libcurl: Unauthorized...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146976)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146976 advisory. A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce...

ALSA-2026:92378 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service v...

ALSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service v...

PT-2026-132087

Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78...

PT-2026-132835

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching sha2 password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the...

CVE-2026-118681

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path...

Azure Kubernetes Configuration Service Applicability Detector

Azure Kubernetes Configuration Service contains a missing authentication vulnerability. This offline tool evaluates strict local CSV or JSON asset inventories for explicit service identifiers and reports applicability only; it does not probe targets or determine current vulnerability status...

PT-2026-133259

Name of the Vulnerable Software and Affected Versions Silverstripe MFA versions prior to 6.0.0 Description In the CMS 5 password reset flow, a logged-in session can be issued after a user changes their password but before the configured multi-factor authentication challenge is completed. This...

UBUNTU-CVE-2026-118264

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later...

UBUNTU-CVE-2026-115644

Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. When operators isolate the admin REST API by explicitly configuring the "admin.listeners" property, REST...

Linux Distros Unpatched Vulnerability : CVE-2026-116794

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's...

Microsoft Entra Application Proxy Service Applicability Detector

Microsoft Entra application proxy contains an improper authentication vulnerability. This offline tool identifies explicitly named service records in local CSV or JSON inventories for applicability review; it does not determine current vulnerability status or remediation...

PT-2026-130666

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an...

Communication-Efficient Private Federated Reinforcement Learning with Post-Quantum Authentication for Vehicular Networks

Federated reinforcement learning supports cooperative vehicular routing without centralizing trajectory data, but model updates may reveal private information and incur communication overhead over intermittent vehicle-to-infrastructure links, particularly when post-quantum authentication is...

WordPress OTP Login With Phone Number, OTP Verification authorization issue vulnerability

WordPress OTP Login with Phone Number and OTP Verification versions 1.8.78 and earlier contain an authorization issue vulnerability. This vulnerability stems from weak authentication mechanisms and may lead to unauthorized authentication attempts...