5970 matches found
CVE-2026-89027
miniOrange JWT Authentication for WP REST APIs plugin for WordPress (before 4.8.0 ) contains an authentication method downgrade vulnerability. An unauthenticated attacker can supply a specific GET parameter that bypasses capability checks and nonce verification, forcing the plugin to use Basic HT...
CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade
miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...
CVE-2026-91923
KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate...
CVE-2026-57134
PraisonAI (npm package praisonai) is a multi-agent teams system. The MCPSecurity.evaluatePolicy() function in src/praisonai-ts/src/mcp/security.ts only invokes the configured credential validator when the AuthMethod is api-key or bearer. For basic and oauth policies, any non-empty Authorization h...
CVE-2026-57134 PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without...
EUVD-2026-78166
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...
CVE-2026-92114: Inefficient Regular Expression Complexity
A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/webcore/src/v09/basiccatalog/functions/saferegex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be...
CVE-2026-57134: Improper Authentication
PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without...
PT-2026-93184
Name of the Vulnerable Software and Affected Versions a2ui-project a2ui versions prior to 0.10.7 Description A remote attack can be launched against the Basic Catalog component due to inefficient regular expression complexity within an unknown function in the file renderers/web core/src/v0 9/basi...
PT-2026-99058
Root has patched AIKIDO-2026-424618 in the basic-ftp package for Root:npm. Multiple fixed versions available...
CVE-2026-91143
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...
CVE-2026-91143 goproxy through 15.3 Authentication Bypass via CONNECT
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...
CVE-2026-91143 goproxy through 15.3 Authentication Bypass via CONNECT
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...
Astra Linux – Vulnerability in Firefox and Thunderbird
The username:password portion was not properly removed from URLs in CSP reports, which could potentially expose HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1...
Astra Linux – Vulnerability in Ansible
A flaw was discovered in Ansible Engine 2.9.18, where sensitive information is not masked by default, and the nolog feature is not protected when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The greatest threat posed by this...
EUVD-2026-76751
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
Linux Distros Unpatched Vulnerability : CVE-2026-90461
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
CVE-2026-90461
A flaw was found in OpenStack Ironic. When the Image Service is configured for HTTPS Basic Authentication, Ironic may inadvertently transmit a username and password to an unintended remote host. This could lead to the disclosure of sensitive authentication credentials to an attacker who controls...