CVE-2026-20326: Missing Authentication for Critical Function

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

PT-2026-93723

Name of the Vulnerable Software and Affected Versions Advantech EKI-1242EIMS version V1.06.01 Description The edgserver management protocol contains a missing authentication flaw. This allows a remote unauthenticated attacker to execute critical device-management functions, such as network...

PT-2026-94030

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An issue exists in the Online Certificate Status Protocol OCSP responder—a protocol used for obtaining the real-time revocation status of digit...

PT-2026-93982

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard affected versions not specified Description An issue exists involving missing authentication for critical functions. This flaw is categorized under CWE-306, which refers to a situation where a critical function is...

Oracle Database Server Unauthorized Access

The vulnerability of the RDBMS component of the database management system, Oracle Database Server, is related to the lack of authentication for critical functions. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

WebLogic Server Proxy Plug-In Unauthorized Access

The vulnerability of the WebLogic Server Proxy Plug-In for third-party web servers within the Oracle Fusion Middleware software platform is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an intruder to gain unauthorized access to create...

Messaging Enabler Component Full Control

The vulnerability of the Messaging Enabler component of the Service Delivery Platform software, part of the Oracle Fusion Middleware software platform, is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to...

Oracle Access Manager Authentication Engine Full Control

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using...

Oracle Unified Directory OUD Core Full Control

The vulnerability of the OUD Core component of the Oracle Unified Directory application, a simplified deployment solution for the Oracle Fusion Middleware software platform, is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker ...

CVE-2026-73173: Missing Authentication for Critical Function

Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including...

CVE-2026-92729: Missing Authentication for Critical Function

SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and...

CVE-2026-73807

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...

CVE-2026-68070

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

CVE-2026-68070

Digital Watchdog VMAX DVR and NVR product lineups are affected by a missing authentication flaw for a critical function, allowing an adjacent-network attacker—requiring no privileges—to execute code as root by passing received bytes directly to a system command (command injection). CISA rates it ...

CVE-2026-68070 Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

EUVD-2026-79949

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

CVE-2026-68070 Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

CVE-2026-54544

Fireshare , a self-hosted media and link sharing platform, contains an unauthenticated SSRF vulnerability prior to version 1.6.16 . Two API endpoints—POST /api/test-discord-webhook and POST /api/test-webhook—are missing the @login_required decorator, allowing an attacker to trigger arbitrary outb...

CVE-2026-54544 Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @loginrequired decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare...

EUVD-2026-79948

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @loginrequired decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare...