PT-2026-70359

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to...

PT-2026-70889

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

PT-2026-70933

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...

PT-2026-70159

FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required ...

CVE-2026-51584

The CVE-2026-51584 entry concerns usememos v0.27.1, where a remote attacker can achieve account takeover through the ssoCredentials branch of the SignIn handler (server/router/api/v1/auth_service.go). The root cause is that SSO identity is matched against an attacker-controllable identifier and i...

PT-2026-70437

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

...[ More ]

A proof of concept exploit for an authentication bypass vulnerability in libssh version 0.12.0. The vulnerability affects servers using GSSAPI key exchange and allows a client possessing a valid Kerberos ticket for any principal in the realm to authenticate as an arbitrary local user. The server...

PT-2026-70564

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper authentication allows an authorized attacker to elevate privileges over a network, enabling them to affect the system. Recommendations At the moment, there is no...

PT-2026-70867

Name of the Vulnerable Software and Affected Versions search-v2-api affected versions not specified Description An authentication bypass exists in the authentication middleware of the affected component. The system unconditionally skips authentication checks when a request contains an Upgrade:...

PT-2026-70926

The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...

PT-2026-70918

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

PT-2026-70365

Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central affected versions not specified Description An authentication bypass exists in the password-reset workflow, which could allow an attacker to perform an account takeover. Recommendations At the moment, there is no...

PT-2026-70111

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent...

Linux Distros Unpatched Vulnerability : CVE-2026-72746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshak...

PT-2026-70038

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to correctly validate client certificates during specific callback flows. An attacker with low privileges who possesses a certificate issued by the same trusted...

PT-2026-70047

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter does not enforce cross-site request forgery CSRF protection on the authentication flow by default. CSRF is a type of attack that tricks a victim into submitting a maliciou...

PT-2026-70928

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and...

PT-2026-70647

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges over a network, enabling them to affect the system. Recommendations At t...

PT-2026-70387

Name of the Vulnerable Software and Affected Versions Microsoft Azure Kubernetes Service affected versions not specified Description Missing authentication for a critical function allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no...

PT-2026-70311

Improper authentication in the IntelR TDX module for some IntelR platforms within Ring 0: Trust Domain may allow an information disclosure and escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This...