A vulnerability in Remote Spark SparkView before build 1122 allows an attacker to bypasses the local connection check and achieve arbitrary code execution as root on the server side. Depending on implementation the vulnerability can be exploited by an unauthenticated attacker.
CVE-2026-7422 is an authentication bypass vulnerability in AWS FreeRTOS-Plus-TCP affecting versions before 4.2.6 and 4.4.1. The flaw allows an adjacent network attacker to bypass checksum and minimum-size packet validation by spoofing the Ethernet source MAC address to match a device's own registered endpoint. This occurs because the loopback detection mechanism skips input validation for packets with a source MAC matching a local endpoint. The vulnerability has a medium severity with a CVSS score of 6.5. Fixed versions 4.2.6 and 4.4.1 are available to mitigate the issue.
CVE-2026-25660 is a critical authentication bypass vulnerability in Ericsson's CodeChecker tool, affecting versions through 6.27.3. The flaw allows an attacker to bypass authentication by manipulating the URL ending with 'Authentication' combined with certain function calls, enabling assignment of arbitrary permissions to any existing user. This vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.
Cloud Foundry UUA versions from v77.30.0 to v78.7.0 and CF Deployment versions from v48.7.0 to v54.14.0 are vulnerable to an authentication bypass. The vulnerability arises when SAML 2.
CVE-2026-39419 is a vulnerability in MaxKB versions 2.7.1 and below that allows an authenticated user to bypass sandbox result validation and spoof tool execution results. The attacker exploits Python frame introspection to read a UUID from bytecode constants and writes a forged result directly to file descriptor 1, bypassing stdout redirection. By calling sys.exit(0), the attacker terminates the wrapper before legitimate output is printed, causing the service to trust the spoofed response. This issue is fixed in version 2.8.0.
Tmds.DBus provides .NET libraries for working with D-Bus from .NET. Tmds.DBus and Tmds.DBus.Protocol are vulnerable to malicious D-Bus peers. A peer on the same bus can spoof signals by impersonating the owner of a well-known name, exhaust system resources or cause file descriptor spillover by sending messages with an excessive number of Unix file descriptors, and crash the application by sending malformed message bodies that cause unhandled exceptions on the SynchronizationContext. This vulnerability is fixed in Tmds.DBus 0.92.0 and Tmds.DBus.Protocol 0.92.0 and 0.21.3.
CVE-2026-3902 is an authentication bypass vulnerability in Django versions prior to 6.0.4, 5.2.13, and 4.2.30. It arises from ambiguous handling of HTTP headers in ASGIRequest, where headers with hyphens and underscores are mapped ambiguously, allowing remote attackers to spoof headers. This can lead to authentication bypass by spoofing. The vulnerability has a high severity with a CVSS score of 7.
OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.
nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the email channel processing module (`nanobot/channels/email.py`), allowing a remote, unauthenticated attacker to execute arbitrary LLM instructions (and subsequently, system tools) without any interaction from the bot owner. By sending an email containing malicious prompts to the bot's monitored email address, the bot automatically polls, ingests, and processes the email content as highly trusted input, fully bypassing channel isolation and resulting in a stealthy, zero-click attack. Version 0.1.6 patches the issue.
CVE-2026-33661 is an authentication bypass vulnerability in the yansongda pay SDK prior to version 3.7.20. The vulnerability arises because the verify_wechat_sign() function skips signature verification if the HTTP request's Host header is set to 'localhost'. This allows an attacker to forge WeChat Pay payment success notifications by sending a crafted request with a 'Host: localhost' header, causing applications to incorrectly mark orders as paid. The issue is fixed in version 3.7.20.
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective. An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a `Nats-Request-Info:` message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker. A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too. Thus identity claims should not have propagated unchecked. Prior to versions 2.11.15 and 2.12.6, NATS clients relying upon the Nats-Request-Info: header could be spoofed. This does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
In N2W before 4.3.2 and 4.4.x before 4.4.1, there is potential remote code execution and account credentials theft because of a spoofing vulnerability.
WebCTRL systems that communicate over BACnet inherit the protocol's lack
of network layer authentication. WebCTRL does not implement additional
validation of BACnet traffic so an attacker with network access could
spoof BACnet packets directed at either the WebCTRL server or associated
AutomatedLogic controllers. Spoofed packets may be processed as
legitimate.
H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastURL) which allows middleware bypass. When event.url, event.url.hostname, or event.url._url is accessed, such as in a logging middleware, the _url getter constructs a URL from untrusted data, including the user-controlled Host header. Because H3's router resolves the route handler before middleware runs, an attacker can supply a crafted Host header (e.g., Host: localhost:3000/abchehe?) to make the middleware path check fail while the route handler still matches, effectively bypassing authentication or authorization middleware. This affects any application built on H3 (including Nitro/Nuxt) that accesses event.url properties in middleware guarding sensitive routes. The issue requires an immediate fix to prevent FastURL.href from being constructed with unsanitized, attacker-controlled input. Version 2.0.1-rc.15 contains a patch for this issue.
CVE-2026-31889 is a high-severity authentication bypass vulnerability in Shopware core affecting versions prior to 6.6.10.15 and 6.7.8.1. It arises from the legacy app registration flow where HMAC-based authentication does not sufficiently bind a shop installation to its original domain. Attackers who possess the app-side secret can abuse the re-registration process to update the shop URL without proving control over the original domain. This allows targeted hijacking of app communication, redirecting traffic to attacker-controlled domains and potentially stealing API credentials.
Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been identified that allows an attacker to issue sessions for arbitrary users using specially crafted ID tokens when the Apple or Azure providers are enabled. The attacker issues a valid, asymmetrically signed ID token from their issuer for each victim email address, which then is sent to the Supabase Auth token endpoint using the ID token flow. If the ID token is OIDC compliant, the Auth server would validate it against the attacker-controlled issuer and link the existing OIDC identity (Apple or Azure) of the victim to an additional OIDC identity based on the ID token contents. The Auth server would then issue a valid user session (access and refresh tokens) at the AAL1 level to the attacker. This vulnerability is fixed in 2.185.0.
OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.