CVE-2026-104046

A flaw was found in SSSD System Security Services Daemon. When Identity Provider IdP authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing...

Denial-of-service (DoS)

org.apache.qpid, protonj2 is vulnerable to a Denial-of-service DoS. The vulnerability is due to excessive type nesting during message processing, which allows a pre-authentication attacker to trigger deeply nested types and cause a StackOverflowError...

Denial-of-service (DoS)

org.apache.qpid, qpid-broker-plugins-amqp-1-0-protocol is vulnerable to a Denial-of-service DoS. The vulnerability is due to improper handling of type size/count values, which allows a pre-authentication attacker to trigger excessive memory allocation...

PT-2026-107230

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 versions prior to 12.4.3-03670 SonicWall SMA1000 versions prior to 12.5.0-03082 Description A pre-authentication server-side request forgery SSRF issue exists in the SMA1000 Appliance Work Place interface. This is caused by a...

CVE-2026-27966

CVE-2026-27966 — Langflow Remote Code Execution Scanner Pre-Auth Route Injection + Vertex Injection → Python Code Execution Overview CVE-2026-27966 is a critical-severity CVSS 9.8 pre-authentication remote code execution vulnerability in Langflow versions prior to 1.8.0. The vulnerability stems...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 - Marimo Pre-Auth RCE xpl0ited by infrar3dh...

Zyxel GS1900 CGI Stack Overflow RCE (CVE-2026-7273)

Exploits CVE-2026-7273 pre-authentication stack-based buffer overflow in Zyxel GS1900 smart-managed switch CGI handlers. Sends an oversized HTTP POST to /cgi-bin/dispatcher.cgi and alternate CGI endpoints to trigger memory corruption and attempt command execution. Firmware = 2.90XXXX.1C0 is...

Denial-of-service (DoS)

org.apache.qpid, qpid-broker-plugins-amqp-1-0-protocol is vulnerable to a Denial-of-service DoS. The vulnerability is due to type nesting that can trigger a StackOverflowError, which allows a pre-authentication attacker to send specially crafted nested data and potentially crash the broker...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated authlength field read from the network triggered a WINPRASSERT failure in rtsreadauthverifiernochecks, causing any FreeRDP client connecting through a malicious RDP Gateway to crash with...

Resource Exhaustion

Apache Qpid ProtonJ2 is vulnerable to Resource Exhaustion. The vulnerability is due to improper handling of type size/count, where excessive memory allocation can occur and a pre-authentication attacker can trigger it to cause a denial of service...

Security Bulletin: IBM QRadar SIEM interation for Microsoft Azure Event Hub contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM integration with Microsoft Azure Event Hub Vulnerability Details CVEID:CVE-2026-66257 DESCRIPTION: A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion...

freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass

A flaw was found in FreeRDP server. This vulnerability allows unauthenticated attackers to bypass server policies that disable Remote Desktop Services over Transport Layer Security RDSTLS connections. By sending incompatible protocol requests and then completing a TLS handshake, attackers can...

Uncontrolled Resource Consumption

Apache Qpid Broker-J is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded caching of symbol values, which allows a pre-authentication attacker to exhaust server resources and cause a denial-of-service condition...

Denial-Of-Service (DoS)

Apache Qpid Proton-J is vulnerable to denial-of-service DoS. The vulnerability is due to improper handling of type size/count values, which allows a pre-authentication attacker to trigger excessive memory allocation and potentially cause a denial of service...

CentOS Linux 8.4 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS8.4:CLSA-2026:1778172123)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1778172123 advisory. - Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker...

PT-2026-105178

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max frame size nor login timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small...

CentOS Linux 8.5 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS8.5:CLSA-2026:1778173027)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1778173027 advisory. - Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker...

Security update for glib2 (moderate)

openSUSE security update: security update for glib2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21977-1 Rating: moderate References: bsc1272206 Cross-References: CVE-2026-15588 CVSS scores: CVE-2026-15588 SUSE : 5.3...

Denial Of Service

Apache Qpid Proton-J is vulnerable to denial of service. The vulnerability is due to unbounded symbol value caching, where the cache can grow without limit and a pre-authentication attacker can send crafted data to exhaust resources, leading to denial of service...

OPENSUSE-SU-2026:21977-1 Security update for glib2

This update for glib2 fixes the following issue: - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206...