MiracleLinux 9 : 389-ds-base-2.8.0-9.el9_8 (AXSA:2026-1635:06)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1635:06 advisory. 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check CVE-2026-11770 389-ds-base: 389-ds-base: NULL pointer dereferen...

CVE-2026-78156: Heap-based Buffer Overflow

A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hssogsdiams6aaircb of the file src/hss/hss-s6a-path.c of the component S6a Authentication-Information-Request Handler. Such manipulation of the argument Visited-PLMN-Id leads to heap-based buffer...

CVE-2026-78434: Missing Authentication for Critical Function

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be...

CVE-2026-78259: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...

CVE-2026-78168: Improper Authentication

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpconchecksessionurl of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed...

CVE-2026-19853: Missing Authentication for Critical Function

NewSiteServer NSS developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality to send emails to anyone on behalf of the school...

CVE-2026-78551: Improper Restriction of Excessive Authentication Attempts

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...

CVE-2026-78255: Missing Authentication for Critical Function

The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...

RHEL 10 : .NET 8.0 (RHSA-2026:58566)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:58566 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It...

The vulnerability of the longestMatch() function in the plugin/transfer/transfer.go file of the CoredNS DNS server allows a hacker to gain unauthorized access to protected information.

The vulnerability of the longestMatch function in the plugin/transfer/transfer.go file of the CoredNS DNS server is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the login() and getFromCookie() functions in the phpMyFAQ web application allows a hacker to disclose sensitive information.

The vulnerability of the login and getFromCookie functions in the phpMyFAQ web application is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to disclose sensitive information that is protected by these functions...

The vulnerability in the Firefox web browser, related to bypassing authentication through spoofing, allows attackers to compromise data integrity.

The vulnerability in the Firefox web browser relates to bypassing authentication through spoofing. Exploiting this vulnerability allows a malicious actor to compromise data integrity remotely...

CVE-2026-71922: NULL Pointer Dereference

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...

PT-2026-80920

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

CVE-2026-78187: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The...

PT-2026-79840

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage wit...

PT-2026-81053

Name of the Vulnerable Software and Affected Versions CakePHP Authentication versions prior to 2.11.2 CakePHP Authentication versions 3.0.0 through 3.3.6 CakePHP Authentication versions 4.0.0 through 4.2.0 Description An authentication bypass and potential CPU or memory exhaustion can occur when...

PT-2026-81054

Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...

PT-2026-80939

Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted...

PT-2026-79813

NewSiteServer NSS developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality to send emails to anyone on behalf of the school...