CVE-2026-107314

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method...

CVE-2026-94053 Apache MINA SSHD: LDAP injection in sshd-ldap

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

CVE-2026-94053

The Apache MINA SSHD Java library is vulnerable to an authentication bypass via LDAP injection within the optional sshd-ldap component. The root cause is a lack of proper escaping for LDAP filter metacharacters, which allows an attacker to successfully authenticate using the username "" and passw...

CVE-2026-79763

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

EUVD-2026-86120

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

CVE-2026-79680: Authentication Bypass Using an Alternate Path or Channel

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared...

CVE-2026-81181: Session Fixation

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor...

PT-2026-95581

Name of the Vulnerable Software and Affected Versions SysReptor versions prior to 2026.68 Description The password authentication flow for protected shared notes fails to rotate the session identifier after successful authentication, leading to session fixation. This occurs when an attacker obtai...

CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...

CVE-2026-19641

CVE-2026-19641 affects Arista EOS devices where password-based login authentication is enabled (e.g., SSH password or Telnet). Due to CWE-116 (Improper Encoding or Escaping) , a specially crafted password can create orphan authentication sessions that accumulate in a limited session pool, eventua...

CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...

CVE-2026-19641: Improper Encoding or Escaping of Output

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then any password will successfully match during authentication, instead of being inactive. This flaw allows an attacker to successfully authenticate as a user whose password h...

Security Advisory 0152

Security Advisory 0152 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-19641 CVSSv3.1 Base Score: 5.3...

CVE-2026-76940

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-76940 Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-76940

CVE-2026-76940 affects the Ebyte NE2-D11 device, which does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This lack of control allows an attacker to perform automated password-based authentication attacks against deployments relying on such aut...

GO-2026-6169 WITHDRAWN: Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile...

SUSE-SU-2026:3526-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. - CVE-2026-7598: integer overflow in function userauthpassword of file src/userauth.c bsc1263890. - CVE-2026-58050: heap buffer...

SUSE CVE-2026-45327

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a ?password= query parameter, comparing the supplied...