CVE-2026-102159 | Critical | 9.8 | 2026-10-06 | An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Success… |
CVE-2026-70411 | High | 7.1 | 2026-10-06 | Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-… |
CVE-2026-63690 | Medium | 5.4 | 2026-10-06 | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-pow… |
CVE-2026-63692 | Critical | 10.0 | 2026-10-06 | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker… |
CVE-2026-63688 | Critical | 10.0 | 2026-10-06 | Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization… |
CVE-2026-106038 | High | 8.2 | 2026-10-06 | Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via… |
CVE-2026-106037 | Critical | 9.8 | 2026-10-06 | Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any r… |
CVE-2026-94293 | Critical | 9.8 | 2026-10-06 | An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints. |
CVE-2026-105486 | High | 7.3 | 2026-10-06 | A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API… |
CVE-2026-105786 | | | 2026-10-06 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/Applicati… |
CVE-2026-71299 | Medium | 6.5 | 2026-10-05 | A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform un… |
CVE-2026-71297 | Medium | 5.4 | 2026-10-05 | A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypas… |
CVE-2026-105307 | High | 7.3 | 2026-10-05 | A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Pe… |
CVE-2026-105170 | High | 7.3 | 2026-10-05 | A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Aff… |
CVE-2026-105207 | Critical | 9.8 | 2026-10-04 | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or… |
CVE-2026-105115 | High | 8.6 | 2026-10-03 | OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers… |
CVE-2026-105105 | Critical | 9.8 | 2026-10-03 | CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 all… |
CVE-2026-105049 | Medium | 5.8 | 2026-10-02 | Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public int… |
CVE-2026-95102 | Critical | 9.4 | 2026-10-02 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weaknes… |
CVE-2026-82042 | Critical | 9.8 | 2026-10-02 | UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a val… |
CVE-2026-103956 | Critical | 10.0 | 2026-10-02 | Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authorit… |
CVE-2026-104446 | Medium | 6.5 | 2026-10-02 | YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's… |
CVE-2026-103765 | Critical | 9.4 | 2026-10-02 | Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attacke… |
CVE-2026-104181 | Medium | 5.4 | 2026-10-01 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication… |
CVE-2026-14983 | | | 2026-10-01 | Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of servi… |
CVE-2026-104058 | Medium | 5.3 | 2026-10-01 | Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protecte… |
CVE-2026-78578 | | | 2026-10-01 | Tapo C120 v1 and C200 v5
do not enforce authentication for do method HTTPS onboarding connect actions
after initial setup. An unauthenticated adjacent
attacke… |
CVE-2026-78577 | | | 2026-10-01 | Tapo C120 v1 and C200 V5
contain a vulnerability in the HTTPS onboarding scan function due to missing authentication.
After initial setup, an unauthenticated a… |
CVE-2026-48005 | High | 7.5 | 2026-10-01 | Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remo… |
CVE-2026-13043 | | | 2026-10-01 | A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated… |
CVE-2026-12423 | High | 7.5 | 2026-10-01 | A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in… |
CVE-2026-103244 | Critical | 9.8 | 2026-10-01 | ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execu… |
CVE-2026-96577 | High | 7.1 | 2026-10-01 | A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encrypt… |
CVE-2026-80276 | High | 7.5 | 2026-10-01 | Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not requi… |
CVE-2026-82825 | Critical | 9.8 | 2026-10-01 | Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invo… |
CVE-2026-76142 | | | 2026-10-01 | Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker t… |
CVE-2026-103539 | Medium | 5.4 | 2026-10-01 | A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantb… |
CVE-2026-103538 | Medium | 6.5 | 2026-10-01 | A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/mai… |
CVE-2026-103536 | High | 7.3 | 2026-10-01 | A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/mai… |
CVE-2026-102150 | High | 7.2 | 2026-09-30 | A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a… |
CVE-2026-102149 | Critical | 9.4 | 2026-09-30 | Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a… |
CVE-2026-102144 | Medium | 5.3 | 2026-09-30 | A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expe… |
CVE-2026-102143 | High | 7.5 | 2026-09-30 | An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload hand… |
CVE-2026-102124 | Medium | 6.5 | 2026-09-30 | A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with n… |
CVE-2026-102121 | High | 8.6 | 2026-09-30 | A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors… |
CVE-2026-102110 | Medium | 5.9 | 2026-09-30 | An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the ini… |
CVE-2026-55094 | | | 2026-09-30 | Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vuln… |
CVE-2026-75969 | | | 2026-09-30 | Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authent… |
CVE-2026-46711 | High | 8.3 | 2026-09-30 | Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0… |
CVE-2026-18783 | High | 8.8 | 2026-09-30 | Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass.
This issue… |
CVE-2026-103270 | High | 7.5 | 2026-09-30 | LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call en… |
CVE-2026-102458 | Critical | 9.8 | 2026-09-30 | EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords thr… |
CVE-2026-93462 | Medium | 5.3 | 2026-09-30 | A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive inf… |
CVE-2026-103057 | Medium | 4.3 | 2026-09-30 | AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POS… |
CVE-2026-103053 | Medium | 5.4 | 2026-09-30 | AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE… |
CVE-2026-53988 | Critical | 10.0 | 2026-09-29 | Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arb… |
CVE-2026-102811 | High | 7.5 | 2026-09-29 | Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, al… |
CVE-2026-66083 | Medium | 6.5 | 2026-09-29 | The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain infor… |
CVE-2026-8065 | Critical | 9.1 | 2026-09-29 | An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to uplo… |
CVE-2026-7395 | | | 2026-09-29 | Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclos… |
CVE-2026-11796 | | | 2026-09-29 | Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which… |
CVE-2026-86158 | High | 7.7 | 2026-09-29 | Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint… |
CVE-2026-102245 | High | 7.3 | 2026-09-29 | A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleb… |
CVE-2026-102363 | Low | 3.7 | 2026-09-29 | mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to re… |
CVE-2026-102362 | Medium | 5.3 | 2026-09-29 | mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbi… |
CVE-2026-102361 | Critical | 9.1 | 2026-09-29 | mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any store… |
CVE-2026-49994 | Critical | 9.1 | 2026-09-28 | Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validati… |
CVE-2026-91154 | | | 2026-09-28 | Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara… |
CVE-2026-101077 | Critical | 10.0 | 2026-09-28 | A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missi… |
CVE-2026-93539 | Medium | 5.4 | 2026-09-28 | A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests… |
CVE-2026-82930 | | | 2026-09-28 | mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authenti… |
CVE-2026-52748 | | | 2026-09-28 | The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthenticated remote att… |
CVE-2026-82383 | High | 8.2 | 2026-09-28 | Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuratio… |
CVE-2026-101004 | Medium | 5.3 | 2026-09-28 | A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/… |
CVE-2026-100903 | Medium | 5.3 | 2026-09-28 | A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST… |
CVE-2026-101065 | Critical | 9.8 | 2026-09-27 | Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts… |
CVE-2026-100876 | Medium | 6.3 | 2026-09-27 | A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the fil… |
CVE-2026-100746 | High | 7.3 | 2026-09-27 | A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the com… |
CVE-2026-100672 | High | 7.5 | 2026-09-26 | The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any… |
CVE-2026-57443 | High | 7.5 | 2026-09-25 | SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`sc… |
CVE-2026-5267 | High | 7.5 | 2026-09-25 | Ciena Navigator Network
Control Suite (NCS) contains an information exposure vulnerability in an
event-streaming API that does not properly enforce authenticat… |
CVE-2026-100192 | Medium | 6.5 | 2026-09-25 | X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Un… |
CVE-2026-56725 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/import_check… |
CVE-2026-97879 | Medium | 5.3 | 2026-09-25 | A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the… |
CVE-2026-97878 | High | 7.3 | 2026-09-25 | A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid… |
CVE-2026-97864 | Medium | 5.3 | 2026-09-25 | A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/units_add_blockAja… |
CVE-2026-84403 | Medium | 6.2 | 2026-09-24 | The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications… |
CVE-2026-88956 | Medium | 6.8 | 2026-09-24 | The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected a… |
CVE-2026-81455 | High | 8.6 | 2026-09-24 | Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated atta… |
CVE-2026-13249 | Critical | 9.8 | 2026-09-24 | An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F… |
CVE-2026-61742 | | | 2026-09-24 | DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint w… |
CVE-2026-97231 | High | 7.3 | 2026-09-24 | A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Inter… |
CVE-2026-86064 | High | 8.6 | 2026-09-23 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api… |
CVE-2026-19267 | Medium | 6.2 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint (`Com… |
CVE-2026-18185 | High | 7.3 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due… |
CVE-2026-73588 | High | 7.4 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unaut… |
CVE-2026-86681 | High | 7.6 | 2026-09-23 | ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to exe… |
CVE-2026-75825 | High | 8.8 | 2026-09-23 | ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerabili… |
CVE-2026-96455 | High | 8.8 | 2026-09-23 | The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps… |
CVE-2026-50227 | | | 2026-09-23 | An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and includin… |