CVE-2026-94606: Improper Authentication

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An...

CVE-2026-91161: Incorrect Authorization

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/sessionId/groups/groupId/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group...

CVE-2026-97062: Improper Neutralization of Input During Web Page Generation

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the...

CVE-2026-97176: Missing Authorization

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how...

CVE-2026-97056: Insufficient Session Expiration

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

CVE-2026-97055: Initialization of a Resource with an Insecure Default

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

PT-2026-98267

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The firmware generates session identifiers using a small sequential value space instead of an unpredictable source. An unauthenticated attacker with adjacent network access and knowledg...

PT-2026-97691

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.98.0 through 0.142.0 Description When configured to use the opaque session tokenizer, the system fails to revoke existing login sessions during password resets or user deletions. This occurs because the DeleteTokensByUserID...

PT-2026-98276

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The firmware fails to properly verify the freshness or client association of authentication values. An unauthenticated attacker with adjacent network access can capture a valid...

PT-2026-98266

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession o...

PT-2026-98265

The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing...

PT-2026-98242

Name of the Vulnerable Software and Affected Versions code16 Sharp versions prior to 9.22.5 Description A stored cross-site scripting issue exists in the rich-text editor because the HTML sanitizer allows the srcdoc attribute on iframe elements. While markup within srcdoc is HTML-encoded during...

PT-2026-98200

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.16.0 Description ZITADEL Login V2 creates a browser session immediately after password verification. This session can be reused for subsequent authentication requests without verifying a user's enrolled second...

PT-2026-97690

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.8.0 through 0.142.0 Description Deployments that do not configure a signing secret for the JWT tokenizer use an empty string as the default HMAC key for signing and verifying session tokens. This occurs because the...

PT-2026-98228

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 3.0.1a Description Sensitive authentication data is exposed in plaintext within the discovery service log files. Individuals with file read access, such as those with access to system logs or support bundles, c...

PT-2026-97827

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.2.0-alpha Description A stored cross-site scripting XSS issue exists that allows unauthenticated users or low-privileged registered users to inject arbitrary JavaScript. The attack occurs when an administrator...

CVE-2026-56736: Improper Neutralization of Input During Web Page Generation

phpMyFAQ is an open source FAQ web application. A stored cross-site scripting XSS vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a...

CVE-2026-4637: Improper Neutralization of Input During Web Page Generation

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

Linux Distros Unpatched Vulnerability : CVE-2026-79313

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead o...

PT-2026-97727

Name of the Vulnerable Software and Affected Versions Rancher affected versions not specified Description An unauthenticated attacker can perform an update of public UI settings to plant malicious content that executes in the browser of users visiting the login page. This stored Cross-Site...