EUVD-2026-48891

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

Open WebUI 'LDAP Empty Password' - Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...

OpenBullet2 <= 0.3.2 - Authentication Bypass

OpenBullet2 = 0.3.2 contains an authentication bypass caused by improper API key authentication middleware handling empty X-Api-Key header, letting unauthenticated attackers gain admin access, exploit requires sending empty X-Api-Key header. id: CVE-2026-25555 info: name: OpenBullet2 = 0.3.2 -...

EUVD-2026-48745

The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid...

CVE-2026-61884

Technical details are not publicly available in the provided documents. Monitor for updates from NVD/CVE and trusted advisories to confirm affected versions, root cause specifics, and remediation.

EUVD-2026-48592

Improper Authentication CWE-287 in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an emp...

CVE-2026-12504 Loytec LINX firmware: Improper Authentication in PAM configuration

Improper Authentication CWE-287 in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an emp...

CVE-2026-12504

Improper Authentication CWE-287 in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an emp...

CVE-2026-12504

Loytec LINX firmware (LINX-A64) products LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD are affected by an Improper Authentication (CWE-287) in PAM configuration through 8.4.16. The root cause is improper PAM authentication that allows a local attacker to authenticate as uid=0 w...

EUVD-2026-48509

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers ...

CVE-2026-50032

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field...

CVE-2026-50032 NULL Pointer Dereference in MZ Automation libIEC61850

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field...

EUVD-2026-48397

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field...

CVE-2026-50032

CVE-2026-50032: A NULL pointer dereference in the MMS Write Named Variable List handler of libIEC61850 (MMS write service) can crash the server when an empty listOfData is sent. Affected in libIEC61850 up to v1.6.1; fix status: patched in v1.6.2 (bd338f23). The issue is a DoS condition exploitabl...

MINI-F4M2-MP2P-C73V

Bulletin has no description...

CVE-2026-64611

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially...

CVE-2026-64611

CVE-2026-64611 affects libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop while processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. This enables a network-adjacent attacker to broadcast a crafted printe...

EUVD-2026-47973

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially...

CVE-2026-64611 Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially...

CVE-2026-64611

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially...