EUVD-2026-97303

A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function getauthenticationdependency of the file auth.py. Such manipulation of the argument securitykey leads to missing authentication. The attack may be launched remotely. The exploit is publicly available and...

CVE-2026-109342: Missing Authentication for Critical Function

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can obtain grant identifiers via ACCESS SHOW ALL with...

CVE-2026-109371: Missing Authentication for Critical Function

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username...

CVE-2026-109571: Missing Authentication for Critical Function

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic 0x2A37. Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairin...

CVE-2026-57118: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /path/list, POST /path, and POST /path/agentid' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let...

CVE-2026-109570: Missing Authentication for Critical Function

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC...

PT-2026-110946

Name of the Vulnerable Software and Affected Versions Fire-Boltt BSW013 firmware versions prior to V0.0.9 Description Missing authentication allows unpaired attackers within Bluetooth range to inject notifications by writing to the proprietary BLE command characteristic. Attackers can craft...

CVE-2026-108921: Missing Authentication for Critical Function

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysqlquery of the file removeannouncements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missi...

CVE-2026-108818: Missing Authentication for Critical Function

A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function getauthenticationdependency of the file auth.py. Such manipulation of the argument securitykey leads to missing authentication. The attack may be launched remotely. The exploit is publicly available and...

PT-2026-110519

Name of the Vulnerable Software and Affected Versions agno-agi agno versions prior to 2.7.4 agno-agi agno versions prior to 3.0.7 Description An issue exists in the get authentication dependency function within the auth.py file. Manipulation of the security key argument allows a remote attacker t...

CVE-2026-92681: Missing Authentication for Critical Function

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. A...

CVE-2026-108863

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /configdump endpoint to read configured LLM provider API...

CVE-2026-108863 Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /configdump endpoint to read configured LLM provider API...

CVE-2026-108863

Katanemo Plano versions through 0.4.37 are vulnerable to a missing authentication flaw on the Envoy admin interface , which is bound to all host interfaces on port 9901 . Unauthenticated network attackers can access the /config_dump endpoint to retrieve LLM provider API keys in plaintext from the...

EUVD-2026-97014

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /configdump endpoint to read configured LLM provider API...

CVE-2026-108863 Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /configdump endpoint to read configured LLM provider API...

CVE-2026-108757

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts int...

CVE-2026-108749

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-108757

The Nexting pinclaw OpenClaw channel plugin, in versions through 0.3.0 , contains a missing authentication vulnerability in src/core/http-router.ts. The flaw occurs because the software fails to perform an authToken check on the POST /pinclaw/send endpoint. Because the service binds to all interf...

CVE-2026-108757 Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts int...