Kaspersky Security Center DoS

The vulnerability in the Agent Administration module and the Server Administration module of Kaspersky Security Center, Kaspersky Security Center Cloud Console, and Kaspersky Endpoint Security Cloud is related to a lack of authentication for a critical function. Exploitation of this vulnerability...

EUVD-2026-111991

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The...

CVE-2026-112197: Tactis NoviGest Desktop App: Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The...

PT-2026-128066

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The...

SourceCodester Online Food Ordering System authorization issue vulnerability

The SourceCodester Online Food Ordering System version 1.0 contains an authorization issue vulnerability. This vulnerability stems from improper handling of the ID parameter in the admin/deleteadmin.php file, resulting in a lack of authentication...

WatchGuard Fireware OS authorization issue vulnerability

Security vulnerabilities exist in WatchGuard Fireware OS versions from 2025.1 up to and including 2026.4, from version 12.0 up to and including 12.12.4, and from version 12.0 up to and including 12.5.22. These vulnerabilities stem from a lack of authentication during FireCluster Sync processing,...

CVE-2026-55463 Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

CVE-2026-55463

The Goobi viewer web application (versions 4.11.0 to before 26.05 ) is vulnerable to authentication and origin validation bypasses in its goobi-viewer-core component. Specifically, several Jakarta WebSocket endpoints (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, and UserEndpoint)...

CVE-2026-55463 Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

CVE-2026-55463 Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

Mervin Praison PraisonAI information disclosure vulnerability

A security vulnerability exists in Mervin Praison PraisonAI versions from 4.2.1 up to and including 4.6.59. This vulnerability stems from the lack of authentication on the AgentOS FastAPI deployment interface; the chat route directly calls agent.chatrequest.message. Unauthenticated attackers can...

ROS-20261023-73-0207

The vulnerability of the SRT transport protocol lies in the lack of authentication for the critical function. This allows attackers to receive unencrypted data packets from any sender, enabling them to intercept streams, inject content, and interrupt direct transmission...

Mervin Praison PraisonAI information disclosure vulnerability

Versions 4.5.115 through 4.6.61 of Mervin Praison PraisonAI contain a security vulnerability. This vulnerability stems from the lack of authentication for A2U subscriptions and event routing; the CLI entry points are not exposed, there is no API key middleware installed, and no A2U tokens are...

NetBox Labs NetBox MCP Server service supply chain issue vulnerability

A security vulnerability exists in NetBox Labs NetBox MCP Server versions prior to 1.2.1. This vulnerability stems from the lack of authentication for HTTP endpoints when TRANSPORT=http is enabled. Any client capable of accessing this port can obtain valid MCP sessions without requiring a token o...

EUVD-2026-105172

ApostropheCMS: Missing Authentication in cleanExport Route...

Windows Performance Optimization Disclosure

The vulnerability of the performance optimization and battery management functions Health and Optimized Experiences in Windows operating systems is related to the lack of authentication for critical functions. Exploiting this vulnerability can allow attackers to disclose protected information...

CVE-2026-113648

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

CVE-2026-113648

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

PT-2026-118492

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description The API endpoint 'POST /api/v1/@apostrophecms/import-export/clean-export' lacks authentication and authorization checks. This allows unauthenticated anonymous users with a...

Azure App Service for Linux Authentication Bypass RCE

The vulnerability of the Azure App Service for Linux platform for deploying, scaling, and administering web applications is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...