210937 matches found
CVE-2026-115678
Arm Keil MDK-Middleware versions 8.0.0-8.3.0 are susceptible to a pre-authentication out-of-bounds read vulnerability during SNMP processing . The issue is categorized under CWE-195 (Signed to Unsigned Conversion Error). While the vulnerability is accessible over the network without authenticatio...
CVE-2026-77061 Missing Authentication for Critical Function in boneIO
boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and...
CVE-2026-77061
The boneIO Black platform is vulnerable to a missing authentication flaw (CWE-306) where several API endpoints are excluded from authentication requirements. An unauthenticated remote attacker on the local network can exploit this to retrieve sensitive information, including system logs , firmwar...
CVE-2026-77061 Missing Authentication for Critical Function in boneIO
boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and...
CVE-2026-77053 Missing Authentication in Default Configuration in boneIO
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuratio...
CVE-2026-77053
The boneIO Black firmware is vulnerable to missing authentication, where the management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, leading to denial of service , configuration ...
CVE-2026-77053 Missing Authentication in Default Configuration in boneIO
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuratio...
CVE-2026-59107
A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices...
CVE-2026-116485
danmuapi before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMINTOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set...
CVE-2026-116214
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because checkmsg never compares msgto. Attackers can request a recovery code to their own mailbox via user/findpassmsg, then submit it to...
CVE-2026-110475
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a val...
CVE-2026-107656
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions ma...
CVE-2026-107656
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions ma...
CVE-2026-107656
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions ma...
EUVD-2026-109831
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions ma...
CVE-2026-107656
An authentication bypass vulnerability (CWE-288) exists in the FortiSandbox web management interface, affecting versions 4.4.0 through 4.4.9 , 5.0.0 through 5.0.6 , and FortiSandbox PaaS versions 4.4.x and earlier (specifically 4.4.0-4.4.9 and 5.0.0-5.0.6). The flaw is caused by hard-coded creden...
Vulnerabilities in HPE Networking AOS
HPE has identified 72 vulnerabilities in HPE Networking’s AOS-8 and AOS-10 platforms, including Mobility Conductors, Mobility Controllers, Mobility Gateways, and Access Points. These vulnerabilities involve various security issues, such as authentication bypass, command and SQL injection, buffer...
EUVD-2026-109828
A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices...
CVE-2026-116485 danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints
danmuapi before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMINTOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set...
CVE-2026-116485
The danmu_api software (versions prior to 1.21.7 ) is vulnerable to an authentication bypass that allows unauthenticated attackers to modify server environment configurations. This occurs when the application uses the default TOKEN and the ADMIN_TOKEN is unset. By sending POST requests to endpoin...