CVE-2026-72586

The CVE-2026-72586 entry describes a missing authentication vulnerability in frangoteam/FUXA up to version 1.3.3. The DAQ_QUERY Socket.IO handler in server/runtime/index.js does not perform isSocketAdminAuthorized token checks, enabling unauthenticated remote access to all historical sensor data....

CVE-2026-72586 frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

CVE-2026-72584

A time-of-check/time-of-use TOCTOU race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes...

CVE-2026-72584 fastschema - TOCTOU Race Condition Bypasses OTP Attempt Limit in Account Recovery

A time-of-check/time-of-use TOCTOU race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes...

CVE-2026-72578 FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

CVE-2026-72577

NASA fprime-gds (through version 3.4.3) contains multiple vulnerabilities that collectively allow unauthenticated remote code execution on the ground station host and the ability to inject commands into connected spacecraft. The Flask application (src/fprime_gds/flask/app.py) applies no authentic...

CVE-2026-72575

CVE-2026-72575 affects daptin v0.12.34. An improper authorization flaw in server/permission/permission.go lets unauthenticated guests with a null UserId perform read, create, update, and delete operations on all usergroup records due to permission checks returning true when p.UserId equals the re...

CVE-2026-72575 daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer in server/permission/permission.go return tr...

CVE-2026-72564 fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...

CVE-2026-72564

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...

CVE-2026-55814

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-55814 Apache Ranger: Download APIs expose plugin data without authentication

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-55248

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-55814

CVE-2026-55814 associates a missing-authentication flaw in the Apache Ranger Download APIs for versions ≤ 2.8.0, potentially exposing plugin data. The issue is mitigated by upgrading to version 2.9.0, which is stated as fixing the vulnerability. Exploitation details or in‑the‑wild status are not ...

CVE-2026-66411

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot...

CVE-2026-66411

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot...

CVE-2026-66411

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot...

CVE-2026-66411

The CVE-2026-66411 entry concerns DEEBOT PRO M1 and DEEBOT PRO K1VAC, where the WebSocket authentication implementation is incorrect (CWE-303). An unauthenticated attacker may connect to and operate the affected robot. Documented impact includes potential unauthorized control of the device, with ...

xss2shell

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...

CVE-2026-66407

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered...