Progress MOVEit Transfer < 2025.1.6 / 2026.0.x < 2026.0.4 Multiple Vulnerabilities (September 2026)

The version of Progress MOVEit Transfer installed on the remote host is prior to 2025.1.6 or 2026.0.x prior to 2026.0.4. It is, therefore, affected by multiple vulnerabilities, including: - Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer...

PT-2026-116107

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...

CVE-2026-103895: Improper Authentication

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the mobypasslogin function. This is due to modelayotpprocess short-circuiting the authentication flow before password validation or...

PT-2026-116150

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.4 Description Improper Authentication allows an unauthenticated user to access system cleanup actions. This issue primarily impacts services directly exposed to the public network, while in-house deployments...

PT-2026-115603

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 5 through 5.0.4 Description An issue involving missing authentication for critical functions and improper neutralization of special elements used in SQL commands allows for SQL Injection. This occurs when certain backend...

PT-2026-116052

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when IS SAAS is true, attackers can enumerate sequential...

CVE-2026-111644: Missing Authentication for Critical Function

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the getcurrentuser dependency. Attackers can read audit logs with login IPs, server...

CVE-2026-111708: Improper Privilege Management

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...

CVE-2026-111701: Missing Authentication for Critical Function

OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/bucketId/path is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object pat...

PT-2026-116105

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing...

CVE-2026-111699: Missing Authentication for Critical Function

Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to rea...

CVE-2026-111694: Missing Authentication for Critical Function

qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDept...

PT-2026-116042

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter...

PT-2026-116093

🚨 CVE-2026-111694 qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and...

PT-2026-116098

🚨 CVE-2026-111699 Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTag...

PT-2026-116058

🚨 CVE-2026-111659 Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSO...

PT-2026-116146

Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended t...

PT-2026-115978

Name of the Vulnerable Software and Affected Versions Microsoft Identity Web affected versions not specified Description An authentication bypass exists due to the use of assumed-immutable data, which allows an authorized attacker to elevate privileges over a network. Recommendations At the momen...

CVE-2026-111388: Improper Access Control

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrictip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses...

CVE-2026-111650: Missing Authentication for Critical Function

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,...