CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-17057

IBM i (versions 7.3, 7.4, 7.5, and 7.6 ) contains a vulnerability in Network File System (NFS) where missing authentication for critical functions (CWE-306) allows a remote, unauthenticated attacker to cause a denial of service and affect data integrity . The CVSS 3.1 score is 6.5 (MEDIUM) with a...

EUVD-2026-71482

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical functions...

EUVD-2026-71123

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhookworktool handler and exploit unvalidated media UR...

EUVD-2026-71228

LobeChat LobeHub 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route /api/agent/webhooks/:platform is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verificatio...

CVE-2026-25938-FUXA-Unauthenticated-RCE

CVE-2026-25938 - ثغرة تنفيذ أوامر عن بُعد غير مصادق عليها في FUXA 1. ما هو FUXA؟ FUXA هي منصة ويب مجانية ومفتوحة المصدر لـ SCADA التحكم الإشرافي والحصول على البيانات و HMI واجهة الإنسان والآلة، تُستخدم في الأتمتة الصناعية وإنترنت الأشياء والتصور اللحظي للعمليات. تتيح للمستخدمين بناء لوحات تحكم...

CVE-2026-73673

CVE-2026-73673: تحديث البرنامج الثابت غير المصادق عليه في Netis NC63 مع غياب المصادقة التشفيرية للبرنامج الثابت البحث الأصلي عن الثغرة بواسطة Özcan Ersan @ozcanpng. يوثّق هذا المستودع CVE-2026-73673، التي اكتشفها المؤلف وأبلغ عنها. حزمة غير تدميرية لإثبات المفهوم والأدلة الخاصة بـ CVE-2026-73673...

CVE-2026-84043

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...

EUVD-2026-70990

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...

CVE-2019-6447-ES-File-Explorer

CVE-2019-6447: ES फ़ाइल एक्सप्लोरर अप्रमाणित HTTP सेवा एक स्वतंत्र रूप से कार्यान्वित, सुरक्षा-चेतना अनुसंधान हार्नेस और CVE-2019-6447 के लिए तकनीकी विश्लेषण, जो एंड्रॉइड के लिए ES फ़ाइल एक्सप्लोरर के असुरक्षित संस्करणों द्वारा उजागर एक अप्रमाणित HTTP सेवा है। केवल अधिकृत अनुसंधान। इस प्रोजेक्ट क...

CVE-2026-75754

Missing Authentication for Critical Function, Server-Side Request Forgery SSRF, and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in wi...

EUVD-2026-70865

Missing Authentication for Critical Function, Server-Side Request Forgery SSRF, and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in wi...

CVE-2026-75754

ASUS Control Center is affected by a combination of Missing Authentication for Critical Function , Server-Side Request Forgery (SSRF) , and Use of Hard-coded Credentials . An unauthorized network-based attacker with no prior privileges can obtain the encryption key via an HTTP request , causing a...

CVE-2026-75754

Missing Authentication for Critical Function, Server-Side Request Forgery SSRF, and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in wi...

EUVD-2026-70816

MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileg...

EUVD-2026-70793

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-71740

No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations...

PT-2026-86252

No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations...

PT-2026-85382

Name of the Vulnerable Software and Affected Versions ASUS Control Center Enterprise versions 0 through 4.0.0.2 Description An issue involving missing authentication for critical functions, Server-Side Request Forgery SSRF, and the use of hard-coded credentials allows an unauthenticated network...

CVE-2026-85424

MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileg...