Plone < 3.0.0 Multiple Vulnerabilities

The version of Plone installed on the remote host is prior to 3.0.0. It is, therefore, affected by the following vulnerabilities: - Plone places a base64 encoded form of the username and password in the ac cookie for the admin account, which makes it easier for remote attackers to obtain...

PT-2026-63485

Name of the Vulnerable Software and Affected Versions Question2Answer versions prior to 1.8.9 Description A session invalidation issue exists where the forgot-password reset flow fails to clear the sessioncode field in the file qa-include/app/users-edit.php. While the standard password-change...

CVE-2026-54478: Authentication Bypass by Spoofing

In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a...

PT-2026-63386

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.18.0 through 1.25.1 Description When the software listens on a 'proxy-protocol-port' interface with answer-cookie: yes, the RFC 9018 server-cookie SipHash is computed using the proxy's wire address rather than the...

Plone < 3.1.8 MitM

The version of Plone installed on the remote host is prior to 3.1.8. It is, therefore, affected by a man-in-the-middle vulnerability. Plone uses invariant data a client username and a server secret when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote...

openSUSE 16 Security Update : python-aiohttp (openSUSE-SU-2026:21372-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21372-1 advisory. This update for python-aiohttp fixes the following issues - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF...

Plone @plone/volto 14.0.0-alpha.5 < 15.0.0-alpha.0 Insecure Authentication

The version of the @plone/volto Node.js Package installed on the remote host is later than 14.0.0-alpha.5 prior to 15.0.0-alpha.0. It is, therefore, affected by an insecure authenticaiton vulnerability. A user could have their authentication cookie replaced with an authentication cookie from...

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

The vulnerability is in the Remember-Me giteaincredible token validation logic, specifically when handling a compromised token hash mismatch. The vulnerable function is this one: https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/authtoken.goL33-L64...

CVE-2026-56581

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

CVE-2026-56581 HCL MyCloud was affected with Cookie Attribute Path Not Set

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

CVE-2026-56581

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

EUVD-2026-46344

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

CVE-2026-56581 HCL MyCloud was affected with Cookie Attribute Path Not Set

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

CVE-2026-56581

CVE-2026-56581 affects HCL MyCloud with a Cookie Attribute Path Not Set issue. The vulnerability is described as enabling potential unauthorized access to session data or authentication tokens due to cookies not setting the Path attribute, increasing exposure. The available sources (NVD/CVELIST) ...

SUSE-SU-2026:22889-1 Security update for curl

This update for curl fixes the following issues - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. - CVE-2026-8458: wrong reuse for different services bsc1268407. - CVE-2026-8924: traling dot domain super cookie bsc1268409. - CVE-2026-8927: env-set cross-proxy Digest auth state leak...

AutoBugBounty

AutoScan — Legendary Bug Bounty Automation Framework ▄█...

httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers

A flaw was found in Apache HTTP Server. This heap-based buffer overflow vulnerability can be exploited by a malicious backend server when using ProxyPassReverseCookie directives. This could lead to a denial of service DoS condition, making the server unavailable to legitimate users...

PT-2026-62007

Name of the Vulnerable Software and Affected Versions HCL MyCloud affected versions not specified Description The software does not set the path attribute for cookies, which may increase the risk of unauthorized access to session data or authentication tokens. Recommendations At the moment, there...

📄 WordPress Booking Activities 1.16.43 Authentication Bypass

WordPress Booking Activities plugin version 1.16.43 contains an authentication bypass vulnerability through Login Without Password. A remote attacker can authenticate without valid credentials and access protected functionality. This proof of concept exploit demonstrates the vulnerable request fl...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2723)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy...