PT-2026-59119

All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file...

CVE-2026-13019

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API...

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE is related to the absence of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2026-1840 Missing authentication for critical function in Hubbell Aclara Metrum Cellular Web Interface

The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This weakness exposes essential configuration settings, allowing attackers to alter operational parameters and trigger system restarts without...

mem0 安全漏洞

mem0 is an open-source benchmark tool for efficient memory algorithms developed by Mem0. Version 1.0.0 of mem0 contains a security vulnerability. This vulnerability stems from the lack of authentication and authorization controls in the memory reset function. Unauthorized attackers could exploit...

CVE-2026-31241

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint DELETE /memories. The endpoint allows unauthenticated users to delete memory records by specifying arbitrary user identifiers e.g., userid, runid, agentid in the request query parameters. A...

CVE-2026-8031 PicoTronica e-Clinic Healthcare System ECHS API Endpoint patient-records missing authentication

A vulnerability was detected in PicoTronica e-Clinic Healthcare System ECHS 5.7. The affected element is an unknown function of the file /cdemos/echs/api/v2/patient-records of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The...

CVE-2026-6126 zhayujie chatgpt-on-wechat CowAgent Administrative HTTP Endpoint missing authentication

A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.0.4. The affected element is an unknown function of the component Administrative HTTP Endpoint. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made...

CVE-2026-32646 Gardyn Cloud API Missing Authentication for Critical Function

A specific administrative endpoint is accessible without proper authentication, exposing device management functions...

Pharos Controls Mosaic Show Controller 访问控制错误漏洞

Pharos Controls Mosaic Show Controller is an embedded control device developed by the British company Pharos, used for lighting control and multimedia scene orchestration. Version 2.15.3 of Pharos Controls Mosaic Show Controller contains a security vulnerability due to the lack of authentication...

CVE-2026-3641

The Appmax plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.0.3. This is due to the plugin registering a public REST API webhook endpoint at /webhook-system without implementing webhook signature validation, secret verification, or any...

CVE-2026-25071

CVE-2026-25071 affects XikeStor SKS8310-8X network switch firmware version 1.04.B07 and earlier. The vulnerability is a missing authentication on the /switch_config.src endpoint, allowing unauthenticated remote attackers to download device configuration files, potentially exposing sensitive VLAN ...

The vulnerability of the Apache NiFi data processing platform, related to the lack of authentication, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Apache NiFi data processing platform lies in the lack of authentication. Exploiting this vulnerability allows a malicious actor to remotely compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the Fortinet FortiManager software, a centralized device management system, relates to the absence of authentication mechanisms. This allows attackers to influence the integrity of the protected information.

The vulnerability of the Fortinet FortiManager device management software lies in the absence of authentication. Exploiting this vulnerability allows a malicious actor to influence the integrity of the protected information...

CVE-2026-2065

A security flaw has been discovered in Flycatcher Toys smART Pixelator 2.0. Affected by this issue is some unknown functionality of the component Bluetooth Low Energy Interface. Performing a manipulation results in missing authentication. The attack can only be performed from the local network. T...

The vulnerability of the software for managing, controlling, and organizing printing processes in Vasion Print Virtual Appliance Host and Print Application lies in the lack of authentication procedures, allowing attackers to execute arbitrary code.

The vulnerabilities of the Vasion Print Virtual Appliance Host and Print Application software for process management, control, and organization are related to deficiencies in authentication procedures. Exploiting these vulnerabilities could allow a malicious actor to execute arbitrary code remote...

The vulnerability of the SAP NetWeaver ABAP software integration platform, related to the lack of authentication, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the SAP NetWeaver ABAP software integration platform is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Cisco Unified Contact Center Express (Unified CCX) Editor software lies in the lack of authentication for a critical function. This allows attackers to circumvent existing security restrictions and increase their privileges.

The vulnerability of the Cisco Unified Contact Center Express Unified CCX Editor software lies in the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker to bypass existing security restrictions and gain increased privileges...

The vulnerability of the Remote-Enabled Function (hdbrss) in the SAP HANA database management system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Remote-Enabled Function hdbrss in the SAP HANA database management system is related to the lack of authentication for this critical function. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected informati...

CVE-2025-64307 Brightpick Mission Control / Internal Logic Control Missing Authentication for Critical Function

The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to manipulate robot control functions, including initiating or halting runners, assigning jobs, clearing stations, and deploying storage totes...