RHEL 9 : redhat-ds:12 (RHSA-2026:56048)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56048 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol...

RHEL 8 : 389-ds:1.4 (RHSA-2026:55794)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55794 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

Moderate: pam security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...

Apple macOS Improper Authentication Vulnerability

Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials...

PT-2026-77116

Name of the Vulnerable Software and Affected Versions MWB HubSpot for WooCommerce versions prior to 1.6.8 Description The software contains a broken authentication mechanism that allows users with Subscriber privileges to bypass authentication requirements. Recommendations Update MWB HubSpot for...

PT-2026-77640

Name of the Vulnerable Software and Affected Versions Oracle Reports Developer version 12.2.1.19.0 Description An issue exists in the Security and Authentication component of Oracle Reports Developer. An unauthenticated attacker with network access via HTTP can exploit this flaw to compromise the...

PT-2026-76959

Name of the Vulnerable Software and Affected Versions Zabbix version 7.4 Description The cryptographic key used for signing Frontend sessions is incorrectly written to the database seed. This issue affects deployments that simultaneously use SAML authentication and guest users, allowing the key t...

EUVD-2021-34863

An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Denial of Service via specially crafted series of HTTP...

PT-2026-77310

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the legacy client-initiated account-linking endpoint of Keycloak. The protection mechanism for the account-linking process uses a predictable hash, which a malicious OpenID...

PT-2026-76926

Name of the Vulnerable Software and Affected Versions karakeep-app karakeep versions prior to 0.32.0 Description An issue in the OAuth Sign-In component, specifically within a function in the apps/web/server/auth.ts file, allows for improper authentication. This flaw can be exploited remotely,...

PT-2026-76943

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...

PT-2026-77197

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.7 Joomla! Core versions 6.0.0 through 6.1.2 Description Insufficient state checks create a vector that allows an attacker to bypass Multi-Factor Authentication MFA checks, which are used to verify a user...

PT-2026-77202

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...

PT-2026-77634

Name of the Vulnerable Software and Affected Versions Oracle Reports Developer version 12.2.1.19.0 Description A security and authentication issue exists in the Oracle Reports Developer product of Oracle Fusion Middleware. A low privileged attacker with network access via CORBA Common Object...

CVE-2021-43717

CVE-2021-43717 affects the Epson EH-TW5350 projector (firmware 150075647YWWV110), specifically the iProjection.apk v3.2.6 component. The root cause is the use of hard-coded authentication credentials , which allows any network attacker to authenticate to the projector and gain full malicious cont...

Microsoft SharePoint Weak Authentication Vulnerability

Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network...

TencentOS Server 4: libsoup3 (TSSA-2026:0839)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0839 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Amazon Linux 2 : tomcat, --advisory ALAS2-2026-3864 (ALAS-2026-3864)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3864 advisory. Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds usi...

RHEL 10 : libssh (RHSA-2026:55855)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55855 advisory. libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fixes: libssh:...

RockyLinux 10 : libssh (RLSA-2026:55855)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55855 advisory. libssh: libssh: information disclosure via short GSSAPI Curve25519 public key CVE-2026-59842 libssh: libssh: denial of service via zero advertised...