CVE-2026-73296

🚨 CVE-2026-73296 - UFO-Vuln 💥 El acceso no autenticado a Mobile MCP puede exponer los datos de la pantalla de Android y proporcionar capacidades de control remoto de la interfaz de usuario a través de ADB. ⚠️ Aviso de seguridad Este repositorio está destinado únicamente a investigación de segurida...

Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure

Arcane 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access id: CVE-2026-42461 info: name: Arcane 1.18.0 - Unauthenticated...

Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console

Juggle ships the H2 database web console enabled and reachable from non-localhost by default. No application-level authentication covers the /h2-console path, and the shipped default datasource credentials sa/juggle are known. An unauthenticated remote attacker can reach the console and, using th...

Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure

Flowise before 3.1.0 contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint, allowing unauthenticated remote attackers to retrieve an organization's complete SSO configuration including OAuth client secrets by providing an organizationId parameter. id: CVE-2026-56270...

CVE-2026-76480

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, has conducted a comprehensive internal security review. This review resulted in software hardening releases...

CVE-2026-76480 Cisco License On-Prem Security Hardening Release

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, has conducted a comprehensive internal security review. This review resulted in software hardening releases...

CVE-2026-76480

The Cisco License On-Prem software (formerly known as Cisco Smart Software Manager On-Prem ) is affected by multiple vulnerabilities grouped under CVE-2026-76480 . These issues are characterized by improper authentication (CWE-306), specifically involving missing authentication for critical funct...

CVE-2026-76480 Cisco License On-Prem Security Hardening Release

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, has conducted a comprehensive internal security review. This review resulted in software hardening releases...

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Summary Both JWT middleware functions JWTMiddleware and JWTMiddlewareV4 immediately return nextc when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under /api/v1, /api/v3, and /api/v4 are completely unauthenticated. Details...

PT-2026-107611

Name of the Vulnerable Software and Affected Versions Cisco License On-Prem affected versions not specified Description Issues with improper authentication were identified in Cisco License On-Prem, formerly known as Cisco Smart Software Manager On-Prem. These issues fall under the Common Weakness...

CVE-2026-20253

Splunk Enterprise — Laboratorio de Entrenamiento CVE-2026-20253 Splunk Enterprise 10.2.3 · sidecar de recuperación PostgreSQL · CWE-306 Autenticación faltante para función crítica Una reproducción autorizada y autocontenida que modela el aviso real para educación defensiva. No incluye código...

CVE-2025-32433

🚨 CVE-2025-32433: RCE no autenticado en el servidor SSH de Erlang/OTP Vulnerabilidad crítica de ejecución remota de código sin autenticación previa Una falla grave en el demonio SSH incorporado de Erlang/OTP permite que atacantes remotos no autenticados logren ejecución remota de código RCE...

Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution

Oracle E-Business Suite 12.2.3 through 12.2.11 is susceptible to remote code execution via the Oracle Web Applications Desktop Integrator product, Upload component. An attacker with HTTP network access can execute malware, obtain sensitive information, modify data, and/or gain full control over a...

Security Bulletin: IBM Guardium Data Protection is affected by vulnerability (CVE-2026-84249)

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-84249 DESCRIPTION: IBM Guardium Data Protection could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...

CVE-2026-20326

Cisco Nexus Dashboard contains a Missing Authentication for Critical Function vulnerability (CWE-306), identified during an internal security review and addressed in a software hardening release . The flaw allows a remote, unauthenticated attacker to perform critical functions over the network wi...

EUVD-2026-81094

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20326 Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Missing Authentication for Critical Function

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20326: Missing Authentication for Critical Function

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-90896

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...

CVE-2026-90896

CVE-2026-90896 is a Missing Authentication for Critical Function (CWE-306) in the MarcosCamara01 Ecommerce Template before commit 91e273c . The GET /api/stripe/checkout_sessions endpoint (in src/app/api/stripe/checkout_sessions/route.ts) calls stripe.checkout.sessions.retrieve() and returns the f...