EUVD-2026-76190

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio fee...

CVE-2026-79394

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio fee...

CVE-2026-72398

CVE-2026-72398 concerns the Linux kernel SCTP implementation. When cookie authentication is disabled, an INIT reconstructed during COOKIE-ECHO could be untrusted unless explicitly re-verified; the patch adds sctp_verify_init() checks after cookie unpacking in COOKIE-ECHO paths and tightens sctp_u...

CVE-2026-72592

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

CVE-2026-53983

The CVE concerns Ground Station prior to 0.6.0, exposing an unauthenticated blind SSRF via the orbital-source URL path. An unauthenticated Socket.IO client can connect on port 7000 (credentials not required, wildcard CORS) and submit a data_submission with submit-orbital-sources to store an attac...

MAL-2026-13414 Malicious code in @atom8n/inspector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b72c3643bb990395103d396d62440db908b84769c904d4c14aa9b259f97807c This @atom8n/-scoped package impersonates Anthropic's official MCP inspector package.json declares author 'Anthropic, PBC' and homepage...

EUVD-2026-52251

Sharp and Toshiba Tec MFPs multifunction printers for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accesse...

CVE-2026-63563

Sharp and Toshiba Tec MFPs multifunction printers for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accesse...

CVE-2026-63563

Sharp and Toshiba Tec MFPs multifunction printers for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accesse...

PT-2026-67408

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description Insufficient validation of the avID parameter in attribute-view read endpoints allows attackers to create traversal paths that escape the storage directory. This enables authenticated users with...

PT-2026-67260

Sharp and Toshiba Tec MFPs multifunction printers for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accesse...

Symantec Identity Manager Management Console Detection

Management Console to administrate Symantec Identity Manager environment, authentication is sometimes disabled. !/usr/bin/env python3 -- coding: utf-8 -- """Management Console to administrate Symantec Identity Manager environment, authentication is sometimes disabled.""" from kittysploit import...

CVE-2026-12255

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

EUVD-2026-49065

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

PT-2026-64832

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

PT-2026-64114

Summary Setting PRAISONAI CALL AUTH=disabled completely disables all authentication on the /api/v1/agents/id/invoke endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations. Details python...

CVE-2026-47393 PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...

CVE-2026-47393

PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator "praisonai.deploy.api.generateapiservercode" that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart "praisonai...

CVE-2026-47393

PraisonAI's code generator for API servers (praisonai.deploy.api.generate_api_server_code) emits a Flask API server with authentication disabled by default. Default config sets auth_enabled=False and auth_token=None, causing check_auth() to short-circuit and accept unauthenticated requests to /ch...

CVE-2026-47393 PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...