CVE-2026-56677 | High | 8.6 | 2026-08-17 | 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-contr… |
CVE-2026-75479 | High | 7.5 | 2026-08-17 | JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate al… |
CVE-2026-75060 | High | 8.4 | 2026-08-17 | In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools |
CVE-2026-71566 | Critical | 9.3 | 2026-08-17 | FakeFish handles incoming credentials by passing them down
to scripts. This works for real hardware because in the end it's up to
the BMC to validate them. H… |
CVE-2026-19971 | Medium | 4.7 | 2026-08-17 | A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manip… |
CVE-2026-74245 | Medium | 5.9 | 2026-08-14 | A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper a… |
CVE-2026-74243 | Medium | 6.5 | 2026-08-14 | A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the… |
CVE-2026-19908 | High | 7.1 | 2026-08-14 | PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and… |
CVE-2026-50027 | Critical | 9.8 | 2026-08-14 | mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served wi… |
CVE-2026-73849 | Critical | 9.8 | 2026-08-14 | Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the… |
CVE-2026-73673 | High | 8.8 | 2026-08-14 | Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmw… |
CVE-2026-72822 | Critical | 9.8 | 2026-08-14 | The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibl… |
CVE-2026-73843 | Critical | 9.6 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing mana… |
CVE-2026-73842 | Critical | 9.0 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api… |
CVE-2026-73666 | High | 8.2 | 2026-08-13 | OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisable… |
CVE-2026-72776 | Critical | 9.8 | 2026-08-13 | AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary com… |
CVE-2026-19749 | Low | 3.7 | 2026-08-13 | A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability… |
CVE-2026-73669 | Medium | 6.3 | 2026-08-13 | The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and n… |
CVE-2026-14525 | Critical | 9.4 | 2026-08-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when th… |
CVE-2026-49827 | Critical | 9.8 | 2026-08-13 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbi… |
CVE-2026-59506 | Critical | 9.3 | 2026-08-13 | CWE-306: Missing Authentication for Critical Function |
CVE-2026-49819 | Critical | 9.8 | 2026-08-13 | UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperus… |
CVE-2026-18673 | | | 2026-08-12 | When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interf… |
CVE-2026-73296 | Critical | 9.4 | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mo… |
CVE-2026-65941 | High | 8.8 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in… |
CVE-2026-19426 | High | 8.2 | 2026-08-12 | POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system. |
CVE-2026-73246 | High | 7.5 | 2026-08-11 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java… |
CVE-2026-73245 | Medium | 6.5 | 2026-08-11 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management… |
CVE-2026-66875 | High | 8.8 | 2026-08-11 | In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silen… |
CVE-2026-66098 | Medium | 6.5 | 2026-08-11 | The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. A… |
CVE-2026-73222 | High | 8.8 | 2026-08-11 | Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option… |
CVE-2026-64921 | High | 8.8 | 2026-08-11 | Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-62777 | High | 7.8 | 2026-08-11 | Missing authentication for critical function in Windows License Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-61367 | High | 7.8 | 2026-08-11 | Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-61365 | High | 7.8 | 2026-08-11 | Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-61364 | High | 7.8 | 2026-08-11 | Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-61356 | High | 7.8 | 2026-08-11 | Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-50516 | Critical | 9.4 | 2026-08-11 | Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-42976 | High | 7.8 | 2026-08-11 | Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally. |
CVE-2026-72920 | Critical | 9.8 | 2026-08-11 | SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication… |
CVE-2026-72748 | Critical | 9.1 | 2026-08-11 | AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4… |
CVE-2026-58115 | Critical | 10.0 | 2026-08-11 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). A… |
CVE-2026-72605 | High | 7.5 | 2026-08-11 | A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profil… |
CVE-2026-72542 | Medium | 5.4 | 2026-08-11 | A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for a… |
CVE-2026-72541 | Medium | 6.5 | 2026-08-11 | A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema… |
CVE-2026-72536 | High | 8.6 | 2026-08-11 | A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription v… |
CVE-2026-72535 | High | 8.6 | 2026-08-11 | A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any… |
CVE-2026-15563 | High | 7.4 | 2026-08-11 | A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and… |
CVE-2026-18941 | High | 7.7 | 2026-08-10 | A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager… |
CVE-2026-15581 | High | 8.0 | 2026-08-10 | A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly acces… |
CVE-2025-15683 | | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can inv… |
CVE-2025-15681 | | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated… |
CVE-2026-72871 | High | 7.5 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/ap… |
CVE-2026-72688 | High | 7.5 | 2026-08-10 | A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documen… |
CVE-2026-72593 | Critical | 9.8 | 2026-08-10 | A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality… |
CVE-2026-72586 | High | 7.5 | 2026-08-10 | A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the D… |
CVE-2026-72577 | Critical | 9.8 | 2026-08-10 | Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station ho… |
CVE-2026-55814 | High | 7.5 | 2026-08-10 | Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue. |
CVE-2026-46409 | Critical | 9.6 | 2026-08-07 | OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backe… |
CVE-2026-61808 | Critical | 9.8 | 2026-08-07 | LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentic… |
CVE-2025-71409 | High | 7.1 | 2026-08-07 | Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading cle… |
CVE-2026-63508 | Critical | 10.0 | 2026-08-07 | Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-70559 | High | 7.5 | 2026-08-06 | Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaC… |
CVE-2026-53984 | Critical | 9.1 | 2026-08-06 | Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_ba… |
CVE-2026-53985 | High | 7.5 | 2026-08-06 | Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows a… |
CVE-2026-53977 | High | 7.5 | 2026-08-06 | OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a PO… |
CVE-2026-18990 | High | 7.3 | 2026-08-06 | A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The m… |
CVE-2026-71319 | Critical | 9.6 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the… |
CVE-2026-69111 | High | 7.5 | 2026-08-05 | Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sen… |
CVE-2026-8446 | High | 7.5 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_en… |
CVE-2026-48911 | High | 7.5 | 2026-08-05 | Insufficient Verification of Data Authenticity vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
A missing authorization check… |
CVE-2026-71289 | Critical | 9.8 | 2026-08-05 | The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API… |
CVE-2026-71262 | Critical | 9.8 | 2026-08-05 | IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController… |
CVE-2026-61891 | High | 7.5 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /f… |
CVE-2026-71241 | High | 7.5 | 2026-08-05 | Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator tha… |
CVE-2026-60009 | High | 8.8 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The han… |
CVE-2026-25703 | High | 7.3 | 2026-08-05 | NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive… |
CVE-2026-71214 | Critical | 9.8 | 2026-08-05 | The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, wh… |
CVE-2026-71203 | Medium | 5.3 | 2026-08-05 | changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource regi… |
CVE-2026-70552 | Critical | 9.8 | 2026-08-04 | MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gate… |
CVE-2026-18810 | High | 7.3 | 2026-08-04 | A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads… |
CVE-2026-69703 | Critical | 9.8 | 2026-08-04 | Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to… |
CVE-2026-63455 | Critical | 9.8 | 2026-08-04 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentic… |
CVE-2026-58071 | | | 2026-08-04 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a shor… |
CVE-2026-24079 | High | 8.1 | 2026-08-04 | Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. |
CVE-2026-61514 | Critical | 9.8 | 2026-08-04 | Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device funct… |
CVE-2026-59913 | High | 7.8 | 2026-08-03 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnerability. A low privi… |
CVE-2026-67610 | High | 8.1 | 2026-08-03 | OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attacker… |
CVE-2026-41452 | Critical | 9.8 | 2026-08-03 | Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the prim… |
CVE-2026-69091 | High | 7.5 | 2026-08-03 | Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modul… |
CVE-2026-68578 | High | 7.5 | 2026-08-02 | ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no… |
CVE-2026-17348 | Medium | 6.5 | 2026-07-31 | In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-m… |
CVE-2026-65311 | Medium | 5.3 | 2026-07-31 | The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA)
in affected versions exposes an undocumented endpoint that changes
the server's logging le… |
CVE-2026-65310 | High | 7.5 | 2026-07-31 | ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration
of affected versions, exposes its data and configuration endpoint
without any authenticat… |
CVE-2026-12562 | High | 8.8 | 2026-07-30 | The RCU II+ and Multiload II+ are vulnerable to an unauthenticated
service that exposes a debug interface granting full root-level access
to the embedded sys… |
CVE-2026-68502 | Critical | 9.8 | 2026-07-30 | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket… |
CVE-2026-67594 | Critical | 9.8 | 2026-07-30 | Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploi… |
CVE-2026-67208 | Critical | 9.8 | 2026-07-30 | Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting… |
CVE-2026-15978 | High | 7.5 | 2026-07-30 | SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to… |
CVE-2026-28814 | High | 7.5 | 2026-07-30 | Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variabl… |