CVE-2026-73421 NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...

CVE-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...

CVE-2026-73420 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

CVE-2026-73842 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-72856 Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner changeTenantOwnerEmail endpoint. On self-hosted instances SELFHOSTED or DISABLEACCOUNTPORTAL set, the cloudRestricted middleware is a no-op and the route is protected only by a...

CVE-2026-72856 Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner changeTenantOwnerEmail endpoint. On self-hosted instances SELFHOSTED or DISABLEACCOUNTPORTAL set, the cloudRestricted middleware is a no-op and the route is protected only by a...

CVE-2026-72856

Budibase before version 3.40.0 contains an authorization/authentication bypass in PUT /api/global/users/tenant/owner (changeTenantOwnerEmail). In self-hosted deployments (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL), cloudRestricted is a no-op and the route is protected only by a general authentication...

CVE-2026-72842 OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories a...

CVE-2026-72842 OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories a...

CVE-2026-72842

The CVE-2026-72842 entry concerns luci-app-lxc on OpenWrt. It describes an ACL inconsistency that lets low-privileged, authenticated LuCI users access backend container management routes without proper authorization checks. A path traversal via /.%2E in the lxc_name parameter can escape container...

CVE-2026-73666 OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...

CVE-2026-73666 OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...

CVE-2026-73666

OpenChoreo OpenShift/Backstage backend vulnerability (CVE-2026-73666) affects OpenChoreo Developer Platform for Kubernetes prior to versions 1.0.4, 1.1.4, and 1.2.1. The Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDe...

Security Bulletin: Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Summary Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit the...

CVE-2026-73665 FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.usecheckAuth in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not...

CVE-2026-73661 FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup

FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore in ampconf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient...

CVE-2026-73661 FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup

FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore in ampconf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient...

CVE-2026-73661

CVE-2026-73661 affects FreePBX by allowing an authenticated user with backup-restore or backup file write access to craft a backup that restores the hidden AUTHTYPE setting to none via runRestore() in amp_conf/htdocs/admin/libraries/Builtin/Restore.php. This enables bypassing the user‑interface r...

EUVD-2026-58484

FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore in ampconf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient...

CVE-2026-19749

A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to...