173004 matches found
CVE-2026-78863
A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfatoken Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...
CVE-2026-53561
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...
CVE-2026-78863 liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication
A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfatoken Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...
CVE-2026-78863 liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication
A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfatoken Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...
EUVD-2026-65468
A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfatoken Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...
CVE-2026-78863
liketrek TREK (versions up to 3.0.22 ) contains an improper authentication vulnerability in the Pre-2FA mfa_token Handler component, specifically in the loginUser function within server/src/services/authService.ts. A remote attacker with low privileges can exploit this flaw to achieve partial com...
cve-2025-29927-lab
Questo repository contiene un'applicazione web deliberatamente vulnerabile realizzata con Next.js. È progettata per dimostrare e studiare il problema di sicurezza noto come CVE-2025-29927. L'obiettivo di questo progetto è aiutare ricercatori di sicurezza, studenti e cacciatori di bug bounty a...
CVE-2026-75037
Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566...
CVE-2026-53561
Apache Hive 4.0.0–4.2.0 contains an improper authentication vulnerability in HiveServer2's SAML bearer-token validation. The flawed code in ThriftHttpServlet.java (doSamlAuth) and HiveSamlAuthTokenGenerator.java accepted attacker-supplied bearer tokens during SAML HTTP authentication without prop...
CVE-2026-53561 Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...
EUVD-2026-65394
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...
CVE-2026-53561 Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...
CVE-2026-75037
LACT (Linux AppContainer Tool), a Linux-based application container management tool, is vulnerable to an authentication bypass through its Polkit authorization mechanism. The root cause lies in the reliance on UnixProcessSubject / Peer PID for Polkit authentication, which can be exploited locally...
CVE-2026-75037 Polkit authentication bypass in LACT
Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566...
CVE-2026-75037 Polkit authentication bypass in LACT
Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566...
EUVD-2026-65390
Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566...
CVE-2026-77130
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key...
CVE-2026-63587
The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically...
CVE-2026-77130
The TYPO3 extension SYSSY – TYPO3 Monitoring & Security Checks (syssy) fails to properly validate the expiration of a client-supplied JWT token . This allows an attacker who already holds a valid SYSSY project API key to continue authenticating with an expired token , effectively bypassing sessio...
EUVD-2026-65345
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key...