335 matches found
CVE-2026-16187 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request...
CVE-2026-16187
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request...
Fides Privacy Center ≤ 2.39.1 - Server-Side URL Disclosure
Fides versions 2.19.0 to before 2.39.2rc0 contain an information disclosure caused by unauthenticated HTTP GET request to the Privacy Center, letting attackers access the SERVERSIDEFIDESAPIURL, which may reveal server configuration details, exploit requires no authentication. id: CVE-2024-31223...
D-Link DIR-859 - Information Disclosure
A critical information disclosure vulnerability exists in D-Link devices where sensitive device account information including credentials can be retrieved by sending an unauthenticated request to /getcfg.php endpoint with the parameter SERVICES=DEVICE.ACCOUNT. This could allow attackers to obtain...
CVE-2026-89080
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to...
EUVD-2026-68892
Tornado: Urlencoded body parsing omits maxnumfields, so one request can stall the event loop...
CVE-2026-47837
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....
PT-2026-81346
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description The Recipe HTTP server in PraisonAI contains an authentication fail-open condition. When authentication is configured as api-key or jwt, the server silently allows unauthenticated requests if the...
CVE-2026-59808
AVideo (through commit 9c39d8c8) is affected by an authentication bypass vulnerability. The root cause lies in deduplicateByEncoderQueueId(), which returns video_id_hash credentials for any video by encoder_queue_id without ownership verification , and useVideoHashOrLogin(), which converts this h...
CVE-2026-72861 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent
The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...
CVE-2026-19725
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...
CVE-2026-19725
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 fails to sanitise a value from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site-to-site transfer key to write a file in any writable directory, including the web root....
EUVD-2026-59918
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...
CVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...
CVE-2026-19050
The CVE concerns the ProSolution WP Client WordPress plugin prior to version 2.0.9. The underlying issue is that the plugin does not validate a user-supplied URL and does not check requester capability or nonce before performing a server-side HTTP request. This allows any authenticated user (e.g....
PT-2026-71311
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...
CVE-2026-18032 WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected...
Information Exposure
Overview org.webjars.npm:nuxt is a Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettings is enabled. An attacker can...
GHSA-WG23-69C2-GJC8 Craft CMS: Passkey login accepts replayed WebAuthn assertions
Craft CMS passkey login accepts WebAuthn requestOptions from the unauthenticated login request body and does not persist the updated credential counter returned by the WebAuthn assertion validator. A captured passkey login request body can therefore be replayed because the old challenge is accept...