CVE-2026-83681

Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally...

CVE-2026-83674

Weak authentication in Active Directory Federation Services AD FS allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-83656

Missing authentication for critical function in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

CVE-2026-70580

Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally...

CVE-2026-70179

Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

CVE-2026-70175

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-70005

Weak authentication in Active Directory Federation Services AD FS allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-69982

Weak authentication in Active Directory Federation Services AD FS allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-69802

Weak authentication in Network Device Enrollment Service NDES allows an unauthorized attacker to execute code over a network...

CVE-2026-62879

Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally...

CVE-2026-110130

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

CVE-2026-107606

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication...

CVE-2026-107607

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication...

CVE-2026-107605

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication...

CVE-2026-105728

Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network...

CVE-2026-104937

Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting XSS. When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker...

CVE-2026-110130

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

CVE-2026-110130

Dockhand versions prior to 1.0.45 are vulnerable to an authentication bypass due to a flaw in the global auth hook. The system incorrectly skips authentication for paths ending in static-asset extensions like .js , even when those paths include /api/ routes . Because user-mutation handlers fail o...

CVE-2026-110130 Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

CVE-2026-110130 Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...