CVE-2026-1840

The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This weakness exposes essential configuration settings, allowing attackers to alter operational parameters and trigger system restarts without...

The vulnerability of the command-line interface of the PAN-OS operating system, which is found in the PA-Series, VM-Series network interfaces, and M-Series virtual devices, allows attackers to escalate their privileges.

The vulnerability of the command-line interface of the PAN-OS operating system’s network interfaces in the PA-Series, VM-Series, and M-Series virtual devices is related to the absence of authentication. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

The vulnerability of the WebCenter Sites component in the user-service provisioning application for the internet. Oracle WebCenter Sites allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the WebCenter Sites application component for online user services in Oracle WebCenter Sites relates to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

The vulnerability of the FortiSandbox threat detection and mitigation system, related to the lack of authentication, allows a violator to execute arbitrary code.

The vulnerability of the FortiSandbox threat detection and mitigation system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary code...

The vulnerability of the access control model for the container registry in the Git repository management system Gitea allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the access control model for the container registry in the Git repository management system Gitea is related to the lack of authentication for the critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

The vulnerability of the XWiki platform for creating collaborative web applications lies in its lack of authentication mechanisms. This allows attackers to create or modify arbitrary files.

The vulnerability of the XWiki Platform lies in the lack of authentication. Exploiting this vulnerability allows a malicious actor to create or modify arbitrary files remotely...

ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model

The distributed pixel cache was originally designed to operate without a challenge–response authentication model. However, given today’s heightened security expectations, we have changed our implementation...

CVE-2026-20223

Cisco Secure Workload is affected by a vulnerability in the access validation of internal REST APIs that could allow an unauthenticated, remote attacker to access site resources with Site Admin privileges. The issue arises from insufficient validation/authentication when accessing REST API endpoi...

The vulnerability of the Craft CMS content management system, related to the lack of authentication, allows a hacker to disclose protected information.

The vulnerability of the Craft CMS content management system is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...

The vulnerability of the Mattermost instant messaging application, related to the lack of authentication, allows a hacker to bypass existing security mechanisms.

The vulnerability of the Mattermost instant messaging application is related to the lack of authentication. Exploiting this vulnerability could allow a malicious actor to bypass existing security measures remotely...

CVE-2026-31240

The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints. Critical functions such as updating memory records PUT /memories/memoryid are exposed without any verification of the requester's identity or permissions. A remote attacker can exploit...

SenseLive X3050 访问控制错误漏洞

The SenseLive X3050 is a data collection and environmental monitoring device designed for IoT scenarios by SenseLive Corporation. The SenseLive X3050 has a access control vulnerability, which stems from the lack of authentication or authorization in the embedded management services. This...

The vulnerability of the Apache Airflow network software, related to the lack of authentication, allows a perpetrator to gain unauthorized access to HITL’s processes.

The vulnerability of the Apache Airflow network software is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the HITL processes...

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, relates to the absence of authentication mechanisms. This allows attackers to manipulate the integrity, accessibility, and confidentiality of information.

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, lies in the lack of authentication. Exploiting this vulnerability allows a malicious actor to manipulate the integrity, accessibility, and confidentiality of information...

The vulnerability of the Remote Desktop Licensing Service for Windows operating systems allows attackers to increase their privileges.

The vulnerability of the Remote Desktop Licensing Service for Windows operating systems is related to the lack of authentication for a critical function. Exploiting this vulnerability can allow attackers to increase their privileges...

The vulnerability of Honeywell CCTV surveillance camera software lies in the lack of authentication for critical functions, allowing intruders to gain unauthorized access to protected information.

The vulnerability of Honeywell CCTV video surveillance software lies in the lack of authentication for critical functions. Exploiting this vulnerability could allow an intruder to gain unauthorized access to protected information...

WWBN AVideo 信息泄露漏洞

WWBN AVideo is a video platform building system written in PHP, developed by the WWBN team. Versions of WWBN AVideo prior to version 26 contain an information leakage vulnerability. This vulnerability stems from the lack of authentication mechanisms, which may lead to information leaks...

Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata

Summary The GET /api/website/title endpoint accepts an arbitrary URL via the websiteurl query parameter and makes a server-side HTTP request to it without any validation of the target host or IP address. The endpoint requires no authentication. An attacker can use this to reach internal network...

The vulnerability in the web interface of the Cisco Evolved Programmable Network Manager (EPNM) allows a attacker to compromise a vulnerable device.

The vulnerability of the Web interface for managing Cisco Evolved Programmable Network Manager EPNM software lies in the lack of authentication. Exploiting this vulnerability allows a malicious actor to compromise the vulnerable device remotely...

Microsoft Azure MCP Server 访问控制错误漏洞

Microsoft Azure MCP Server is a core server component developed by Microsoft Corporation in the United States, used for managing and coordinating services and resources on the Azure cloud platform. There is an access control vulnerability in Microsoft Azure MCP Server; this vulnerability stems fr...