CVE-2026-123197

A flaw was found in wppconnect-server due to missing authentication on static file endpoints. An unauthenticated remote attacker can exploit this issue by enumerating timestamp-based file paths in requests to retrieve decrypted sticker media across sessions. This allows unauthorized access to...

360WFP_Exploit

360WFPExploit A proof-of-concept PoC demonstrating potential abuse of the 360 Security WFP driver 360netmonx64wfp.sys interface, aimed at verifying the risk that IOCTL interfaces without caller authentication may be misused by third-party programs. This project is intended for security research a...

KOMTEK Cassa Kurier Module Authentication Bypass

Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management is associated with the absence of authentication for a critical function. Exploitation of this vulnerability may allow an attacker to compromise the integrity and accessibility of...

Ascon.Pilot.WinService Auth Bypass Code Execution

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Ascon.Pilot.WinService Authentication Bypass

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker operating remotely to compromise the confidentiality, integrity, and accessibility o...

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure

Flowise before 3.1.0 contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint, allowing unauthenticated remote attackers to retrieve an organization's complete SSO configuration including OAuth client secrets by providing an organizationId parameter. id: CVE-2026-56270...

Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/fID accepts an integer file ID in the URL and returns internal site structure data page IDs, versions, URL paths to anyone who sends a GET request. id:...

Docker-Proxy hubcmdui - Missing Authentication on /api/config

Docker-Proxy through 5.1.9 exposes the hubcmdui configuration endpoint /api/config without authentication. An unauthenticated remote attacker can read the full server configuration, including the WeChat/Telegram monitoring webhook URLs and bot token inside monitoringConfig, the menuItems structur...

argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access

argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token. id:...

NeuVector - Information Disclosure

NeuVector through 5.4.9 contains an information disclosure vulnerability caused by missing authentication and cached sensitive data in the manager /network/graph API, letting remote attackers access sensitive information, exploit requires no special privileges. id: CVE-2026-25703 info: name:...

CyberPower - Missing Authentication

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. id: CVE-2024-32735 info: name: CyberPower - Missing Authentication author: DhiyaneshDK severity: critical description: | An issue regarding missing authentication for certai...

Discourse - Unauthenticated Mailpace Webhook Bounce-Score Forgery

Discourse's WebhooksController contains a missing-authentication flaw caused by accepting requests to provider webhook endpoints including /webhooks/mailpace, SendGrid, Mailjet, Mandrill, Postmark, and SparkPost without validating a token when none is configured, which is the default state, letti...

CVE-2026-82033

A flaw was found in DeepSeek Harness. A missing authentication check in its Remote Procedure Call RPC control plane allows an unauthorized local attacker to access internal session interfaces. By interacting with these unauthenticated endpoints, an attacker can bypass human approval safeguards,...

EUVD-2026-117872

Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled the default...

CVE-2026-110390

The FlexNet Beacon component in Flexera One and FlexNet Manager Suite is vulnerable to a missing authentication flaw (CWE-306). When anonymous web server access is enabled—which is the default configuration—unauthenticated remote attackers can obtain Beacon policy and targeting information . This...

CVE-2026-123206 EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key

EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile accepts a null user id. Attackers holding an attachment object key can omit or...

EUVD-2026-117651

EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile accepts a null user id. Attackers holding an attachment object key can omit or...

CVE-2026-123206

EdgeChat versions prior to 2.20.3 are vulnerable to a missing authentication flaw in the GET /files/:key route. The vulnerability exists because the canAccessFile() function incorrectly accepts a null user id , allowing unauthenticated or banned users to download decrypted public-channel attachme...

CVE-2026-123197

WPPConnect Server versions through 2.10.76 are vulnerable to an unauthenticated sticker media disclosure vulnerability. The root cause is a missing authentication check on the /files static mount. Attackers can bypass per-session token checks by enumerating Unix timestamps in GET /files/file.webp...