tag
Authentication
Medium
YAMCS Missing Rate Limiting on Authentication Endpoint (CVE-2026-44596)
CVE-2026-44596 / GHSA-w5r6-mcgq-7pq4·
yamcs-core (YAMCS mission control software)
patched
Medium
WebSocket Authentication Brute-Force via Missing Rate Limiting (CVE-2026-27778)
CVE-2026-27778·
Generic Node.js/Express + ws WebSocket authentication server (demonstration/simulator app)
patched
Medium
Vendure GraphQL Admin API Authentication Timing Attack / User Enumeration (CVE-2026-25050)
CVE-2026-25050·
Vendure (NativeAuthenticationStrategy.authenticate(), Admin GraphQL API)
unpatched
Critical
Strapi CMS Admin Account Takeover via Query Filter Bypass — CVE-2026-27886
CVE-2026-27886·
Strapi CMS (Content API)
unpatched