Client accepts unsolicited RawPublicKey server certificate type
CVE-2026-89136
When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited s
#cwe-287
共收录 1077 条相关情报。
← 返回所有主题Client session cache reference poisoning allows resumption with wrong server
CVE-2026-94419
Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of th
A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App ...
CVE-2026-100746
CVE-2026-100746 影响 coollabsio Coolify 4.1.0 及更早版本,问题出在 GitHub App 设置处理流程中的重定向功能 Github::redirect,对应 HTTP 路由为 /webhooks/s
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable...
CVE-2026-85984
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up ...
CVE-2026-85984
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens)...
CVE-2026-100709
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the a
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during ...
CVE-2026-100709
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the a
Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the in...
CVE-2026-100684
Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server.
Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any ex...
CVE-2026-100607
Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifi
Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a ...
CVE-2026-100606
Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login pat
Froxlor before 2.3.12 2FA Bypass via Namespace Confusion
CVE-2026-100709
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the a
Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC
CVE-2026-100684
Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server.
Flowise through 3.1.4 Authentication Bypass via Email-Only SSO
CVE-2026-100607
Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifi
Flowise through 3.1.4 Authentication Bypass via SSO Email Match
CVE-2026-100606
Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login pat
Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization...
CVE-2026-81473
Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low priv
Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization...
CVE-2026-56792
Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low priv
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
CVE-2026-57178
### Impact The `vk-app` backend accepted VK application callback data without verifying the callback signature when the
social-auth-core has an Improper Authentication issue
CVE-2026-57175
### Impact The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that t
phpMyFAQ's two-factor authentication login bypasses the password factor
CVE-2026-56737
### Summary The public two-factor verification endpoint `POST /check` logs a user in based **solely** on a valid 6-digit
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all...
CVE-2026-19125
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includi