10 posts tagged with "auth-bypass".
All postsInside CVE-2026-74820: a CVSS 10.0 unauthenticated SQL injection in ServiceNow's AI Platform, reachable through a dynamic schema ORDER BY cl...
Inside CVE-2026-85978: a path normalization gap between Akana Policy Manager's auth filter and its servlet dispatcher lets an unauthenticate...
Inside CVE-2026-78174: WatchGuard Dimension writes Super Administrator session tokens into a diagnostic log any lower-privileged Administrat...
Inside CVE-2026-58155: Apache Traffic Server silently truncated over-length HTTP header names instead of rejecting them, enabling header ali...
Inside wp2shell (CVE-2026-60137 + CVE-2026-63030): a REST batch route desync in WordPress core unblocks an author__not_in SQL injection, cha...
Inside CVE-2025-29927: a forged x-middleware-subrequest header makes Next.js skip its own middleware, bypassing every authentication and aut...
Inside CVE-2026-20253 (CVSS 9.8): Splunk Enterprise's PostgreSQL backup sidecar trusted the network instead of the request, letting an unaut...
Inside CVE-2026-20245: an unvalidated file-path argument to a privileged tenant-list upload script lets a netadmin execute commands as root...
Inside CVE-2026-43640: the C# short-circuit boolean that lets any authenticated Bitwarden admin with a stolen session pull or rotate the org...
CVE-2026-41940 is a critical (CVSS 9.8) authentication bypass in cPanel and WHM that lets unauthenticated attackers gain root-level server a...
Connect your repositories and let AI agents handle continuous scanning, research, and triage.
Choose which categories you are happy to allow. You can change your mind at any time using the Cookie settings link in the footer.