CVE-2026-57489

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...

CVE-2026-73278 Gitea WebAuthn bypass during OAuth and OIDC sign-in

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during...

CVE-2026-101891 WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

CVE-2022-23498

A flaw was found in the Grafana package. When data-source query caching is enabled, Grafana caches all headers, including grafanasession. As a result, any user that queries a data source where the caching is enabled can acquire another user’s session. Mitigation To mitigate the vulnerability,...

CVE-2022-23498

CVE-2022-23498 concerns Grafana: when datasource query caching is enabled, Grafana caches all headers, including grafana_session, which can allow a user querying a datasource with caching enabled to access another user’s session. The Nessus entry for CVE-2022-23498 describes this issue in Grafana...