CVE-2026-111322 | Critical | 9.8 | 2026-10-15 | Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which bind… |
CVE-2026-111312 | High | 7.7 | 2026-10-15 | OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that que… |
CVE-2026-105038 | Critical | 9.8 | 2026-10-15 | The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticate… |
CVE-2026-105034 | High | 8.2 | 2026-10-15 | The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker ca… |
CVE-2026-84731 | Critical | 9.8 | 2026-10-15 | An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a craft… |
CVE-2026-39997 | | | 2026-10-15 | A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote… |
CVE-2026-34006 | | | 2026-10-15 | A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote a… |
CVE-2026-76659 | High | 7.5 | 2026-10-15 | A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service. |
CVE-2026-76656 | Medium | 5.3 | 2026-10-15 | A
vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote
attacker to cause a denial of service when traceroute is executed und… |
CVE-2026-110838 | High | 7.5 | 2026-10-14 | FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers… |
CVE-2026-71854 | High | 8.2 | 2026-10-14 | OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.26062… |
CVE-2026-64856 | Low | 3.7 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does no… |
CVE-2026-57492 | High | 7.4 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing us… |
CVE-2026-104110 | Medium | 5.3 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.24.0, FileRise Pro /api/pro/portals/get.php… |
CVE-2026-104106 | Medium | 6.5 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated sess… |
CVE-2026-110669 | Medium | 6.5 | 2026-10-14 | A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such m… |
CVE-2026-55786 | High | 8.4 | 2026-10-14 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-R… |
CVE-2026-102748 | | | 2026-10-14 | Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication wh… |
CVE-2026-100406 | | | 2026-10-14 | dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0… |
CVE-2026-109439 | Critical | 9.8 | 2026-10-14 | Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to rea… |
CVE-2026-110632 | High | 8.1 | 2026-10-14 | Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater… |
CVE-2026-110619 | Medium | 4.8 | 2026-10-14 | frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because… |
CVE-2026-110618 | High | 8.1 | 2026-10-14 | SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke… |
CVE-2026-110616 | High | 8.1 | 2026-10-14 | NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the… |
CVE-2026-16740 | Critical | 9.8 | 2026-10-14 | Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on phy… |
CVE-2026-103905 | High | 7.5 | 2026-10-14 | The authentication middleware of the JTL-Shop
administration backend processes the plugin safe mode toggle on the admin
logout route before checking whether th… |
CVE-2026-109969 | Medium | 4.7 | 2026-10-14 | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or p… |
CVE-2026-108473 | | | 2026-10-14 | Multiple
Kasa devices contain an improper authentication vulnerability in the local
device-management protocol. An unauthenticated adjacent attacker may send
m… |
CVE-2026-97793 | High | 7.0 | 2026-10-13 | Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally. |
CVE-2026-96858 | Medium | 5.5 | 2026-10-13 | Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally. |
CVE-2026-96313 | High | 7.0 | 2026-10-13 | Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
CVE-2026-96183 | Medium | 5.5 | 2026-10-13 | Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally. |
CVE-2026-85884 | High | 7.8 | 2026-10-13 | Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-83928 | High | 8.8 | 2026-10-13 | Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. |
CVE-2026-83854 | Medium | 5.5 | 2026-10-13 | Improper access control in Windows Notification allows an authorized attacker to disclose information locally. |
CVE-2026-83715 | High | 7.1 | 2026-10-13 | Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally. |
CVE-2026-83656 | Medium | 4.7 | 2026-10-13 | Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. |
CVE-2026-83654 | High | 7.8 | 2026-10-13 | Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
CVE-2026-70580 | High | 8.8 | 2026-10-13 | Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally. |
CVE-2026-70137 | Medium | 5.5 | 2026-10-13 | Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally. |
CVE-2026-62879 | Medium | 5.5 | 2026-10-13 | Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally. |
CVE-2026-107607 | Medium | 6.2 | 2026-10-13 | SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on… |
CVE-2026-107606 | Medium | 6.2 | 2026-10-13 | SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on… |
CVE-2026-107605 | Medium | 6.2 | 2026-10-13 | SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on… |
CVE-2026-105728 | High | 7.5 | 2026-10-13 | Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network. |
CVE-2026-69227 | Critical | 9.8 | 2026-10-13 | A flaw in Portal for ArcGIS allows unauthenticated access to
certain Portal Administrator API endpoints under specific conditions. This could enable an attac… |
CVE-2026-55183 | Critical | 9.6 | 2026-10-13 | RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rc… |
CVE-2026-110128 | High | 7.5 | 2026-10-13 | fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via t… |
CVE-2026-110114 | Medium | 6.5 | 2026-10-13 | FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes b… |
CVE-2026-106043 | High | 7.5 | 2026-10-13 | A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modi… |
CVE-2026-77096 | | | 2026-10-13 | CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS. |
CVE-2026-65173 | Critical | 9.1 | 2026-10-13 | NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit c… |
CVE-2026-65131 | Medium | 6.0 | 2026-10-13 | NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where the gRPC health-event interface, exposed over a world-writable… |
CVE-2026-89309 | Critical | 10.0 | 2026-10-13 | The authorization middleware of the WMS MobileServer
fails to require authentication in two distinct cases. First, it
only requires an Authorization header for… |
CVE-2026-87689 | Critical | 9.8 | 2026-10-13 | The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route… |
CVE-2026-84313 | High | 8.8 | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside Re… |
CVE-2026-109571 | Medium | 4.3 | 2026-10-12 | Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart… |
CVE-2026-109570 | Medium | 4.3 | 2026-10-12 | Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by… |
CVE-2026-109575 | Critical | 9.8 | 2026-10-12 | In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic th… |
CVE-2026-57118 | Critical | 9.8 | 2026-10-12 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `P… |
CVE-2026-108921 | High | 7.3 | 2026-10-12 | A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query o… |
CVE-2026-109371 | High | 8.2 | 2026-10-12 | ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bo… |
CVE-2026-109342 | Medium | 5.4 | 2026-10-12 | SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated caller… |
CVE-2026-92681 | | | 2026-10-12 | In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ign… |
CVE-2026-93693 | Medium | 6.5 | 2026-10-12 | In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response fo… |
CVE-2026-108818 | High | 7.3 | 2026-10-12 | A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependency of the file auth.py. Such manipulati… |
CVE-2026-108863 | High | 7.5 | 2026-10-11 | Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface… |
CVE-2026-108757 | Medium | 6.5 | 2026-10-11 | Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check… |
CVE-2026-108749 | Low | 3.7 | 2026-10-11 | docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/me… |
CVE-2026-108739 | High | 7.5 | 2026-10-11 | OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all worksp… |
CVE-2026-108549 | High | 8.1 | 2026-10-10 | cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthent… |
CVE-2026-108263 | Critical | 9.9 | 2026-10-09 | Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workf… |
CVE-2026-107824 | | | 2026-10-09 | x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP… |
CVE-2026-75597 | Medium | 5.3 | 2026-10-09 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/bluepri… |
CVE-2026-33367 | High | 8.1 | 2026-10-09 | SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware… |
CVE-2026-85479 | Medium | 5.3 | 2026-10-09 | The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker c… |
CVE-2026-105281 | High | 7.5 | 2026-10-09 | The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can… |
CVE-2026-78025 | High | 7.5 | 2026-10-09 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unaut… |
CVE-2026-77900 | Critical | 9.8 | 2026-10-08 | Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network. |
CVE-2026-84249 | Critical | 9.8 | 2026-10-08 | IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critic… |
CVE-2026-11318 | High | 7.8 | 2026-10-08 | Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers t… |
CVE-2026-107779 | Critical | 9.8 | 2026-10-08 | Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoControll… |
CVE-2026-84272 | Critical | 9.8 | 2026-10-08 | IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker coul… |
CVE-2026-104076 | Critical | 9.1 | 2026-10-08 | TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated… |
CVE-2026-9209 | Critical | 9.8 | 2026-10-08 | mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postb… |
CVE-2026-105110 | Critical | 9.8 | 2026-10-08 | OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands… |
CVE-2026-85489 | High | 8.8 | 2026-10-08 | An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to… |
CVE-2026-85423 | High | 8.8 | 2026-10-08 | A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fai… |
CVE-2026-85421 | High | 8.8 | 2026-10-08 | A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or acce… |
CVE-2026-87664 | High | 7.8 | 2026-10-08 | A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing l… |
CVE-2026-87659 | Critical | 9.8 | 2026-10-08 | A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connec… |
CVE-2026-76268 | Critical | 9.8 | 2026-10-07 | In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Applic… |
CVE-2026-76480 | Critical | 9.8 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software… |
CVE-2026-62253 | Critical | 9.8 | 2026-10-07 | Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediate… |
CVE-2026-107207 | High | 7.2 | 2026-10-07 | LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass t… |
CVE-2026-107206 | Critical | 9.4 | 2026-10-07 | LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to acce… |
CVE-2026-107205 | High | 8.6 | 2026-10-07 | LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access it… |
CVE-2026-107204 | Critical | 9.8 | 2026-10-07 | LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to… |
CVE-2025-70520 | Critical | 9.8 | 2026-10-07 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of rest… |
CVE-2025-70516 | Critical | 9.1 | 2026-10-07 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of rest… |