CVE-2026-61884 Tycon Systems TPDIN-Monitor-WEB2 Missing Authentication for Critical Function

The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network acces...

CVE-2026-61884 Tycon Systems TPDIN-Monitor-WEB2 Missing Authentication for Critical Function

The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network acces...

GO-2026-5954 GoBGP confederation validation panics on empty AS_PATH attribute in github.com/osrg/gobgp

GoBGP confederation validation panics on empty ASPATH attribute in github.com/osrg/gobgp...

GHSA-7G7R-GX96-252G electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`

Summary AppImage targets built by app-builder-lib could use an empty path component when setting the LDLIBRARYPATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by...

CVE-2026-12504 Loytec LINX firmware: Improper Authentication in PAM configuration

Improper Authentication CWE-287 in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an emp...

CVE-2026-12504

Loytec LINX firmware (LINX-A64) products LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD are affected by an Improper Authentication (CWE-287) in PAM configuration through 8.4.16. The root cause is improper PAM authentication that allows a local attacker to authenticate as uid=0 w...

CVE-2026-12504 Loytec LINX firmware: Improper Authentication in PAM configuration

Improper Authentication CWE-287 in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an emp...

EUVD-2026-48592

Improper Authentication CWE-287 in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an emp...

CVE-2026-12504

Improper Authentication CWE-287 in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an emp...

Authentication Bypass

LiteLLM is vulnerable to Authentication Bypass. The vulnerability is due to improper handling of the MCP authentication fallback path, where failed LiteLLM key validation is replaced with an empty authentication object, which allows an unauthenticated attacker to exploit the MCP Streamable HTTP...

OESA-2026-3174 buildah security update

The package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a new image...

EUVD-2026-48509

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers ...

PT-2026-64420

Name of the Vulnerable Software and Affected Versions Tycon Systems TPDIN-Monitor-WEB2 affected versions not specified Description The web management interface fails to perform server-side validation of credentials during the login process. An unauthenticated remote attacker can bypass the...

MiracleLinux 9 : openssl-3.5.5-4.el9_8.ML.1 (AXSA:2026-1339:14)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1339:14 advisory. openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing CVE-2026-7383 openssl: OpenSSL: Denial of Service due...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when the request body exceeds the configured maxBodyBytes limit, resulting in the full payload being forwarded to the upstream service while policy evaluation occurs against an empty parsedbody. An attacker can...

CVE-2026-50032

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field...

CVE-2026-50032 NULL Pointer Dereference in MZ Automation libIEC61850

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field...

CVE-2026-50032 NULL Pointer Dereference in MZ Automation libIEC61850

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field...

CVE-2026-50032

CVE-2026-50032: A NULL pointer dereference in the MMS Write Named Variable List handler of libIEC61850 (MMS write service) can crash the server when an empty listOfData is sent. Affected in libIEC61850 up to v1.6.1; fix status: patched in v1.6.2 (bd338f23). The issue is a DoS condition exploitabl...

CVE-2026-50032

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field...