EUVD-2026-80318

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

CVE-2026-82311 Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

Security update for kbd

This update for kbd fixes the following issue: CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that allows passwordless root login bsc1275441. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:4207-1 Security update for kbd

This update for kbd fixes the following issue: - CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that allows passwordless root login bsc1275441...

CVE-2026-27546

An unauthenticated remote attacker can exploit an authentication bypass in the accountlog function to log in as an admin, even when accounts are properly configured...

CVE-2026-27546 Authentication Bypass in _account_log

An unauthenticated remote attacker can exploit an authentication bypass in the accountlog function to log in as an admin, even when accounts are properly configured...

EUVD-2026-80229

An unauthenticated remote attacker can exploit an authentication bypass in the accountlog function to log in as an admin, even when accounts are properly configured...

CVE-2026-27546

CVE-2026-27546 is an authentication bypass in the _account_log function , allowing an unauthenticated remote attacker to log in as an admin even when accounts are properly configured. The vulnerability is rated CVSS 9.8 (CRITICAL) by CERT-VDE (CNA), with references to advisories VDE-2026-028, VDE...

CVE-2026-27546 Authentication Bypass in _account_log

An unauthenticated remote attacker can exploit an authentication bypass in the accountlog function to log in as an admin, even when accounts are properly configured...

CVE-2026-29861

CVE-2026-29861 🛡️ Divulgación de CVE: CVE-2026-29861 — Inyección SQL en PHP-MYSQL-User-Login-System Fecha de divulgación: 10 de abril de 2026 ID de CVE: CVE-2026-29861 Gravedad: CRÍTICA CVSS 9.8 🧩 Resumen Existe una vulnerabilidad crítica de inyección SQL en PHP-MYSQL-User-Login-System v1.0,...

EUVD-2026-80173

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

CVE-2026-92358 Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

CVE-2026-92358

Keycloak 's first broker login flow contains a flaw where a temporary proof created during a cross-browser account-linking request is not properly cleared after the link is established or manually removed. An attacker who controls the external identity can exploit this residual proof to silently ...

CVE-2026-92358

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

PT-2026-93339

An unauthenticated remote attacker can exploit an authentication bypass in the account log function to log in as an admin, even when accounts are properly configured...

Linux Distros Unpatched Vulnerability : CVE-2026-90011

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: target: iscsi: Reserve a terminator byte for the login payload iscsitargetcheckloginrequest rejects a login PDU whose DataSegmentLength exceeds...

CVE-2026-91843 - Stack overflow in login process to the Security Management and Log Servers

Symptoms - Issue: A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges. This issue received the ID CVE-2026-91843 and a CVSS score of 9.8. Affected Products: Security Management Server, Multi-Domain Security Management...

CVE-2026-33017-langflow-rce

CVE-2026-33017 — Langflow 未认证远程代码执行（RCE） 概述 CVE ID: CVE-2026-33017 受影响软件: Langflow 受影响版本: = 1.9.0 严重性: 严重 作者: r3nsi15 日期: 2026 描述 Langflow 暴露了一个公开的流程构建端点（/api/v1/buildpublictmp/flowID/flow），该端点接受任意 CustomComponent 代码块并在服务器端无需认证即可执行。通过将恶意 Python 载荷注入到 CustomComponent 节点的 code 字段，未经认证的攻击者可以以 Langfl...

CVE-2024-57610

Falta de limitación de tasa en Sylius v2.0.2 Página de inicio del proveedor: https://sylius.com/ Pasos para reproducir 1. Navegue a https://store.sylius.com/login 2. Intente múltiples solicitudes de inicio de sesión utilizando herramientas o scripts automatizados por ejemplo, Burp Suite, cURL. 3...

CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...