CVE-2026-19863: protected resources when using EthereumAuthenticator if the request path
- Severity
- 9.3 (CRITICAL)
- Vendor
- ECLIPSE
- Patch status
- Unknown
- Published
- 2026-10-15T10:17:12.497
- Modified
- 2026-10-15T10:17:12.497
Why it matters
This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.
Recommended admin actions
- Prioritize validation immediately due to critical CVSS severity.
- Treat internet-facing systems as higher priority.
- Review logs for suspicious activity related to the affected application or component.
Technical summary
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.
View the official NVD record for CVE-2026-19863
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
815 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-55572 |
e107 PATCH
Reporter: SECURITY-ADVISORIES
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-77524 |
KEDA is a Kubernetes-based Event Driven Autoscaling component. In PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-108390 |
Hestia Control Panel is a lightweight and powerful control panel for the modern web PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-107424 |
Frontend Dashboard PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108291 |
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-16740 |
TR7 ASP: from 1.0.40.236 PATCH
Reporter: ILETISIM
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-16741 |
TR7 ASP: from 1.0.40.236 PATCH
Reporter: ILETISIM
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108065 |
Channel Software WebAlliance eCommerce [VERSION — missing]
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-59774 |
Gitea
Reporter: 88EE5874-CF24-4952-AEA0-31AFFEDB7FF2
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-76519 EXPLOITED |
Cisco Secure Email
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55573 |
e107 is a content management system (CMS) PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55680 |
WeGIA is a web manager for charitable institutions PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55683 |
WeGIA is a web manager for charitable institutions PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55684 |
WeGIA is a web manager for charitable institutions PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110911 |
Wheels 1.1.8 PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108587 |
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-109145 |
User Rights Access Manager
Reporter: CONTACT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-109694 |
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-93483 |
Product identification pending
Reporter: CVE
|
9.5
CRITICAL
|
VIEW RECORD |
| CVE-2026-16438 |
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64
Reporter: MITSUBISHIELECTRIC.PSIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-50612 |
An unix symbolic link (symlink) following vulnerability
Reporter: SECURITY
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2020-37282 |
office-converter
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110612 |
vlife
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110631 |
Komodo
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110634 |
git-diff PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110635 |
webp-converter PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110636 |
pypdftk
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110638 |
doc-recog
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110639 |
@mborne/extract PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110640 |
Whisper-node
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110643 |
transcribe2texts
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110644 |
nodejs-whisper
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110645 |
Video-stitch PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110649 |
Stills PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110650 |
The thumbnail Python package
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101950 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101956 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101967 |
Junos OS Evolved
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101980 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101986 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101990 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102031 |
Junos OS Evolved
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102175 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102178 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102182 |
the kmd component of Juniper Networks Junos OS on MX Series PATCH
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109439 |
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-33792 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-33796 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101954 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101982 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101983 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-103415 |
ECLIPSE
Reporter: EMO
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-77371 |
redash PATCH
Reporter: SECURITY-ADVISORIES
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-92152 |
fprime PATCH
Reporter: SECURITY-ADVISORIES
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110536 |
DIR-868L
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110862 |
Better Auth from 1.4.0-beta.18 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101287 |
Authentication bypass vulnerability in Stela PATCH
Reporter: CVE-COORDINATION
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-19863 |
protected resources when using EthereumAuthenticator if the request path
Reporter: EMO
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-34006 |
A missing authentication for critical function vulnerability
Reporter: SECURITY
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-47786 |
An OS command injection vulnerability
Reporter: SECURITY
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-50619 |
A path traversal vulnerability
Reporter: SECURITY
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-108497 |
an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking
Reporter: AUDIT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2020-37281 |
Gravitee API Management
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110616 |
NullHub
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110628 |
Kan 0.5.5
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110632 |
MyReport Updater
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110646 |
Beganovich snappdf from 1.1.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-15176 |
NGINX Plus
Reporter: F5SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-93479 |
NGINX Plus
Reporter: F5SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-97205 |
NGINX Plus
Reporter: F5SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-101955 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-101997 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102037 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102062 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102068 |
Junos OS Evolved
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102070 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102084 |
the VPN daemon of Juniper Networks Junos OS on SRX Series PATCH
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-33789 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102748 |
Dgraph is an open source distributed GraphQL database PATCH
Reporter: SECURITY-ADVISORIES
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110770 |
Databasus 3.7.0
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110858 |
GitPython from 3.1.30 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102469 |
Eclipse Vert.x
Reporter: EMO
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-16436 |
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS
Reporter: MITSUBISHIELECTRIC.PSIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102893 |
Zulip is an open-source team collaboration tool. In Zulip Server PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-102476 |
Eclipse Vert.x
Reporter: EMO
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-85714 |
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-108335 |
HITACHIVANTARA
Reporter: SECURITY.VULNERABILITIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-108336 |
HITACHIVANTARA
Reporter: SECURITY.VULNERABILITIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-110864 |
Better Auth from 1.5.0-beta.12 PATCH
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-86002 |
Dokku is a docker-powered platform as a service. In Dokku PATCH
Reporter: SECURITY-ADVISORIES
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-91881 |
Dell Terraform Provider for Redfish PATCH
Reporter: SECURITY_ALERT
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-110867 |
Renovate PATCH
Reporter: DISCLOSURE
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-39997 |
A missing authentication for critical function vulnerability
Reporter: SECURITY
|
8.9
HIGH
|
VIEW RECORD |
| CVE-2026-106599 |
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-71184 |
Gitea
Reporter: 88EE5874-CF24-4952-AEA0-31AFFEDB7FF2
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-87093 |
MOVEit Transfer PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-89067 |
MOVEit Transfer PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-101966 |
the jti-dialoutd of Juniper Networks Junos OS Evolved
Reporter: SIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-107350 |
PgBouncer
Reporter: F86EF6DC-4D3A-42AD-8F28-E6D5547A5007
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-86461 |
FV Flowplayer Video Player
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.