CVE-2026-46560

OpenAM Authentication Bypass via RADIUS Spoofing

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the outstanding request, or verify the RFC 2865 `Response Authenticator`; the RFC 2869 `Message-Authenticator` is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success. On a deployment with a `RADIUS` module instance enabled on a login chain, an unauthenticated network attacker can race the real server on-path or spray forged `Access-Accept` packets off-path and obtain a session for any `RADIUS`-mapped username without knowing the shared secret. Unlike CVE-2024-3596, exploitation requires no MD5 chosen-prefix forgery because no response authenticator is checked. The resulting session carries the impersonated principal's privileges. This issue is fixed in version 16.1.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2009-4139

Spacewalk-java: spacewalk: red hat network satellite: spacewalk java: privilege escalation via cross-site request forgery

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Network Satellite Network Satellite Server Rhel Els and 1 more

CVE-2026-93008

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Dnsmasq Red Hat Redhat

Products

Dnsmasq Enterprise Linux Ceph Storage and 6 more

CVE-2026-119711

PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Pipeshub

Products

Pipeshub

CVE-2026-118265

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Labstack

Products

Echo

CVE-2026-3012

Samba: group policy certificate enrollment uses http:// without validation

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Enterprise Linux Eus Openshift and 8 more

CVE-2026-16460

Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Bootc Redhat

Products

Bootc Enterprise Linux Hardened Images and 3 more

CVE-2025-13947

Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 4 more

CVE-2026-82332

Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking

An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-118377

mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mewebstudio

Products

Pos

CVE-2026-117928

Same-origin policy bypass in the CSS Parsing and Computation component

Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-115413

AWS API MCP Server OAuth Token Audience Validation Bypass

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate this issue, users should upgrade to version 1.6.0 and configure the expected token audience or client ID for the server.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Aws-api-mcp-server

CVE-2026-104381

Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-117912

Same-origin policy bypass in the CSS Parsing and Computation component

Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2024-3049

Booth: specially crafted hash can lead to invalid hmac being accepted by booth server

A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Clusterlabs Redhat

Products

Booth Enterprise Linux Enterprise Linux Eus and 10 more

CVE-2024-1249

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Amq Broker Amq Streams Build Keycloak and 12 more

CVE-2026-114456

Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers

Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener reflected an arbitrary request's Origin header into its CORS response headers and accepted the first token-bearing request it received during the login window without verifying a CSRF state value bound to that specific login attempt. An attacker able to reach the listener during an active login might have leveraged this to submit a forged callback response, causing the authentication attempt to fail. The fix is available in Snowflake Connector for Python 4.8.0, Snowflake Go Driver v2.3.0, Snowflake JDBC Driver 4.4.0 (including the snowflake-jdbc-fips and snowflake-jdbc-thin artifacts), Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1. Go v1 users must migrate to the latest major version of the module. Users must manually upgrade.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-110021

Missing GSDX SignatureValue verification

PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Phoenix Contact Phoenixcontact

Products

Plcnext Engineer Plcnext Engineer

CVE-2006-4339

Openssl: openssl: signature forgery via improper pkcs-1 padding removal leading to certificate validation bypass

A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating a hash. This allows remote attackers to forge PKCS #1 v1.5 signatures. Consequently, OpenSSL may incorrectly verify X.509 and other certificates, leading to a bypass of trust and authentication mechanisms.

CVSS 3.1 · 9.1 Critical EPSS 3.9% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Core Services and 4 more

CVE-2026-121637

WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results

An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Authpoint Authentication Gateway