CVE-2026-79850
No description provided
CVSS
10.0
Critical
EPSS
0.4%
p33
KEV
—
Exploit Today
10
0-100
Published: Oct 22, 2026 · Last modified: Oct 23, 2026 · CWE-288
Not enough EPSS history yet.
No description provided
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-7984410.0 CRI33.1%
——10No description provided17hCVE-2026-1147326.8 MED28.4%
——9Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.2dCVE-2026-963873.8 LOW9.5%
——3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.1dCVE-2026-963856.5 MED10.7%
——3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.1dCVE-2026-84923—15.8%
——5Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.2dCVE-2026-1146358.7 HIG9.1%
——3Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.1d