179898 matches found
EUVD-2026-58055
A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges...
com.ongres.scram/scram-client: com.ongres.scram/scram-common: SCRAM Libraries: Authentication downgrade via TLS man-in-the-middle attack
A flaw was found in the SCRAM Salted Challenge Response Authentication Mechanism client and common libraries. An attacker performing a man-in-the-middle MITM attack on a Transport Layer Security TLS connection can silently downgrade the authentication process. This vulnerability allows the attack...
com.ongres.scram/scram-client: com.ongres.scram/scram-common: SCRAM Libraries: Authentication downgrade via TLS man-in-the-middle attack
A flaw was found in the SCRAM Salted Challenge Response Authentication Mechanism client and common libraries. An attacker performing a man-in-the-middle MITM attack on a Transport Layer Security TLS connection can silently downgrade the authentication process. This vulnerability allows the attack...
Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.33.3 release and security update
An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...
CVE-2026-49820 Probo has an open redirect bypass via path normalization
Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Probo's saferedirect package validates redirect URLs used across authentication flows OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links. Prior to version...
CVE-2026-49820
Probo (go.probo.inc/probo) carries a path normalization bug in its saferedirect redirect validator. Before patch 0.193.1, the validator only inspected the second character of relative paths, allowing crafted URLs like /../\evil.com to pass validation; Go's http.Redirect then normalizes the path t...
CVE-2026-66658
Subscriber SQL Injection in Reviewer = 3.14.2 versions...
CVE-2026-66465
Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...
CVE-2026-66453
Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...
CVE-2026-28185
Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...
CVE-2026-28008
Unauthenticated Broken Authentication in OAuth Single Sign On – SSO OAuth Client = 7.0.0 versions...
CVE-2026-28148
Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...
OESA-2026-3395 libssh2 security update
libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS22, SECSH-USERAUTH25, SECSH-CONNECTION23, SECSH-ARCH20, SECSH-FILEXFER06, SECSH-DHGEX04, and SECSH-NUMBERS10. Security Fixes: libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count fr...
OESA-2026-3392 libssh2 security update
libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS22, SECSH-USERAUTH25, SECSH-CONNECTION23, SECSH-ARCH20, SECSH-FILEXFER06, SECSH-DHGEX04, and SECSH-NUMBERS10. Security Fixes: libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count fr...
OESA-2026-3368 coredns security update
CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins. Security Fixes: CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport...
CVE-2026-66465 WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability
Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...
CVE-2026-66465
CVE-2026-66465 affects WordPress Cartify theme (Cartify Multipurpose) versions up to and including 1.3.0.1, with unauthenticated broken authentication that can lead to account takeover. The connected documents confirm the vulnerability type and the affected version range but do not provide remedi...
CVE-2026-66465
Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...