Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

Pinterest Automatic < 4.14.4 - Unauthenticated Arbitrary Options Update

The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wppinterestautomaticparserequest' function and the 'processform.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to...

Flowise <= 1.8.2 Authentication Bypass

An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality. id: CVE-2024-8181 info: name: Flowise = 1.8.2 Authentication Bypass author:...

Langflow OSS - Superuser Token Issuance

Langflow OSS with default AUTOLOGIN exposes /api/v1/autologin, which returns a superuser access token to any unauthenticated request. id: CVE-2026-9103 info: name: Langflow OSS - Superuser Token Issuance author: str4k3r severity: critical description: | Langflow OSS with default AUTOLOGIN exposes...

Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass

Crawl4AI Docker API server versions before 0.8.7 ship with a hardcoded default JWT signing key "mysecret" used to sign and verify HS256 authentication tokens. Because the key is identical across every deployment where SECRETKEY has not been overridden, an unauthenticated attacker can forge a vali...

MLflow Job API - Authentication Bypass

MLflow latest version contains an authentication bypass caused by unprotected FastAPI job endpoints under /ajax-api/3.0/jobs/ when basic-auth is enabled, letting unauthenticated network clients submit and manage jobs, exploit requires job execution enabled and allowlisted job functions. id:...

N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution

N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication remote code execution via static code injection CWE-96. An unauthenticated attacker with network access to the N-central management interface can execute arbitrary code on the server, potentially compromising every...

Audiobookshelf - Authentication Bypass

Audiobookshelf contains a path traversal caused by improper authentication-exemption check on URL-encoded paths in server/routers/Auth.js, letting unauthenticated attackers read arbitrary files, exploit requires crafted URL with encoded traversal sequences. id: CVE-2026-71209 info: name:...

SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass

SimpleHelp = 5.5.15 and 6.0 pre-release contain an authentication bypass caused by lack of cryptographic signature verification in OIDC tokens, letting remote unauthenticated attackers gain technician sessions, exploit requires OIDC authentication configured. id: CVE-2026-48558 info: name:...

D-Tale <= 3.16.0 - Pre-Auth RCE via Pandas Query Injection

D-Tale prior to version 3.16.1 contains a remote code execution caused by the update-settings endpoint allowing updates to enablecustomfilters, letting attackers run malicious code on the server, exploit requires hosting D-Tale publicly. id: CVE-2024-55890 info: name: D-Tale = 3.16.0 - Pre-Auth R...

MStore API <= 3.9.2 - Authentication Bypass

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers ...

UniFi OS - Authentication Bypass via Path Traversal (..%2f)

UniFi OS devices contain an improper access control vulnerability caused by insufficient authorization checks, letting network attackers make unauthorized system changes, exploit requires network access. id: CVE-2026-34908 info: name: UniFi OS - Authentication Bypass via Path Traversal ..%2f...

New API < v0.12.10 - Stripe Webhook Bypass

New API v0.12.10 contains a broken authentication caused by unauthenticated attacker forging Stripe webhook events, letting attackers credit arbitrary quota without payment, exploit requires no authentication. id: CVE-2026-41432 info: name: New API v0.12.10 - Stripe Webhook Bypass author: str4k3r...

phpBB < 3.3.17 - Authentication Bypass

phpBB before 3.3.17 contains an authentication bypass vulnerability in the login-link feature. By setting the authprovider query parameter to "apache", an unauthenticated attacker can bypass password verification and log in as any user, including administrators. The Apache auth provider trusts th...

Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass

The official Gitea Docker image through version 1.26.2 ships with REVERSEPROXYTRUSTEDPROXIES set to a wildcard, causing Gitea to trust reverse-proxy authentication headers X-WEBAUTH-USER from any source IP instead of restricting trust to the configured reverse proxy. When reverse-proxy...

Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. id: CVE-2020-29453 info: name: Jira Server Pre-Auth - Arbitrary File...

OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation

OpenCTI 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internalid UUID instead of a valid JWT. The default admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f grants full admin access to the GraphQL API, effectively bypassing all authentication. id:...

Krayin CRM < 2.2.1 - Installer Authentication Bypass

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware caused by bypassing the CanInstall middleware redirect check via crafted HTTP POST requests, letting unauthenticated remote attackers overwrite the primary administrator account and gain full administrati...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

Xiaomi Mi WiFi R3G Routers - Local file Inclusion

Xiaomi Mi WiFi R3G devices before 2.28.23-stable are susceptible to local file inclusion vulnerabilities via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication. id: CVE-2019-18371...