190335 matches found
ROS-20260820-73-0004
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260820-73-0002
The vulnerability in Gitea is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the SCRAM authentication subsystem in the PostgreSQL database management system allows a hacker to disclose sensitive information that is protected by this system.
The vulnerability of the SCRAM authentication subsystem in the PostgreSQL database management system is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow an attacker to disclose sensitive information...
The vulnerability of the logical decoding mechanism of the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the logical decoding mechanism in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Oracle Linux 10 : glib2 (ELSA-2026-57015)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-57015 advisory. - Fix CVE-2026-15588: limit D-Bus auth line read length - Fix CVE-2026-58011: range validation in gdatetimeaddfull - Fix CVE-2026-58012: buffer...
PT-2026-78915
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...
TrueConf Server Missing Authentication for Critical Function Vulnerability
TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script...
The vulnerability in the social_login.cgi script of the Zyxel networking device allows attackers to bypass existing security mechanisms.
The vulnerability of the sociallogin.cgi script of the Zyxel networking devices is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...
PT-2026-79183
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active...
PT-2026-79226
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication...
PT-2026-79172
Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Improper authentication in the system could allow a remote attacker to execute arbitrary code. Recommendations At the moment, there is no information about a newer version...
PT-2026-79145
Name of the Vulnerable Software and Affected Versions Centrifugo versions prior to 6.9.0 Description Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The...
PT-2026-79046
Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description An issue allows any user authenticated to the manager to create, modify, and delete Data Node definitions, leading to files or directories being accessible to external parties...
PT-2026-78932
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description The GraphQL node fails to properly handle connection-level errors, re-throwing the underlying HTTP client error without wrapping it in the...
PT-2026-79009
ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...
PT-2026-78987
Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...
PT-2026-79103
Name of the Vulnerable Software and Affected Versions Omada gateways affected versions not specified Description A pre-authentication OS command injection exists in Omada gateways configured as an OpenVPN Server. The issue stems from insufficient validation of client-supplied data during the...
PT-2026-79060
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password hash is None. A fresh deployment reaches that state when DBX PASSWORD is unset and no stored password...
CVE-2026-53424: Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decodeidpauthresp/3 in lib/samly/helper.ex calls esamlsp:validateassertion/2, whose default duplicate detector is ...