Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

210717 matches found

Mend
Mend•added 2026/10/16 5:39 p.m.•10 views

CVE-2026-111694

qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDept...

6.9CVSS5.9AI score0.00564EPSS
SaveExploits0References7
osv_cve
osv_cve•added 2026/10/16 5:39 p.m.•4 views

CVE-2026-111694 qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints

qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDept...

6.9CVSS5.9AI score
SaveExploits0References7
Cvelist
Cvelist•added 2026/10/16 5:39 p.m.•32 views

CVE-2026-111694 qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints

qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDept...

6.9CVSS0.00564EPSS
SaveExploits0References5
CVE
CVE•added 2026/10/16 5:39 p.m.•19 views

CVE-2026-111694

The qKnow software versions through 2.4.3 are vulnerable to a missing authentication flaw in the /flyflow workflow integration endpoints. Due to improper security configurations in SecurityConfig , unauthenticated remote attackers can access specific endpoints like /flyflow/userById , roleAll , a...

6.9CVSS5.9AI score0.00564EPSS
SaveExploits0References5
EUVD
EUVD•added 2026/10/16 5:39 p.m.•11 views

EUVD-2026-102985

qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDept...

6.9CVSS5.9AI score0.00564EPSS
SaveExploits0References5
osv_cve
osv_cve•added 2026/10/16 5:39 p.m.•8 views

CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to ga...

9.3CVSS6AI score
SaveExploits0References8
CVE
CVE•added 2026/10/16 5:39 p.m.•29 views

CVE-2026-111692

The DataBuff ai-apm-web component (through version 0.1.10 ) contains a critical authentication bypass vulnerability caused by a hardcoded HMAC secret in the JwtTokenService . Unauthenticated attackers can exploit this by using the default dev-secret to forge admin session tokens with future expir...

9.8CVSS5.9AI score0.00607EPSS
SaveExploits0References6
Cvelist
Cvelist•added 2026/10/16 5:39 p.m.•38 views

CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to ga...

9.8CVSS0.00607EPSS
SaveExploits0References6
Vulnrichment
Vulnrichment•added 2026/10/16 5:39 p.m.•12 views

CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to ga...

9.8CVSS5.9AI score0.00607EPSS
SaveExploits0References6
EUVD
EUVD•added 2026/10/16 5:39 p.m.•15 views

EUVD-2026-102983

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to ga...

9.8CVSS6AI score0.00607EPSS
SaveExploits0References6
Mend
Mend•added 2026/10/16 5:39 p.m.•11 views

CVE-2026-111691

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

9.1CVSS5.9AI score0.00409EPSS
SaveExploits0References6
CVE
CVE•added 2026/10/16 5:39 p.m.•29 views

CVE-2026-111691

The WIMOOR software (through commit ec86736 ) contains an authentication bypass vulnerability caused by the processing of an unsigned X-USERINFO header. Attackers who can reach backend service ports directly—bypassing the gateway—can forge companyid and manager or admin usertype values. This allo...

9.1CVSS5.9AI score0.00409EPSS
SaveExploits0References3
osv_cve
osv_cve•added 2026/10/16 5:39 p.m.•6 views

CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

9.1CVSS5.9AI score
SaveExploits0References6
EUVD
EUVD•added 2026/10/16 5:39 p.m.•17 views

EUVD-2026-102982

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

9.1CVSS5.9AI score0.00409EPSS
SaveExploits0References3
Cvelist
Cvelist•added 2026/10/16 5:39 p.m.•35 views

CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

9.1CVSS0.00409EPSS
SaveExploits0References3
osv_cve
osv_cve•added 2026/10/16 5:39 p.m.•5 views

CVE-2026-111690 Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

9.3CVSS5.9AI score
SaveExploits0References7
Cvelist
Cvelist•added 2026/10/16 5:39 p.m.•35 views

CVE-2026-111690 Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

9.8CVSS0.00578EPSS
SaveExploits0References4
EUVD
EUVD•added 2026/10/16 5:39 p.m.•12 views

EUVD-2026-102981

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

9.8CVSS5.9AI score0.00578EPSS
SaveExploits0References4
Mend
Mend•added 2026/10/16 5:39 p.m.•9 views

CVE-2026-111690

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

9.8CVSS5.9AI score0.00578EPSS
SaveExploits0References7
Vulnrichment
Vulnrichment•added 2026/10/16 5:39 p.m.•9 views

CVE-2026-111690 Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

9.8CVSS5.9AI score0.00578EPSS
SaveExploits0References4
Rows per page
Query Builder