PT-2026-66377

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

CVE-2026-66723 Missing authentication requirement in Remote Instances proxy API in MWDB Core

MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...

EUVD-2026-50359

MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...

CVE-2026-13423 Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...

CVE-2026-13423

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...

PT-2026-65809

MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...

CVE-2026-54635 pytonapi has a Webhook Custom Path Authentication Bypass

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup stores...

pytonapi has a Webhook Custom Path Authentication Bypass

Webhook Custom Path Authentication Bypass in pytonapi Summary TonapiWebhookDispatcher in pytonapi 2.2.0 fails to validate the Authorization header when a webhook handler is registered with the documented path= argument. During setup, bearer tokens are stored only under the default suffix paths...

EUVD-2026-49900

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

EUVD-2026-49884

NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption by submitting concurrent unauthenticated profiling requests. A successful exploit of this vulnerability might lead to denial of service an...

CVE-2026-47483

NVIDIA DCGM Exporter (all platforms) has a vulnerability in the /debug/pprof endpoints that allows an attacker to cause uncontrolled resource consumption by issuing concurrent unauthenticated profiling requests. This can lead to denial of service and information disclosure. The CVSS 3.1 base metr...

PT-2026-65588

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request...

CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-12982

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users...

CVE-2026-12982

The Document Gallery WordPress plugin versions before 5.1.1 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitise and escape user input before it is reflected in the response of an unauthenticated AJAX action . This flaw can be e...

EUVD-2026-49068

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users...

Denial Of Service

React Router is vulnerable to Denial Of Service. The vulnerability is due to insufficient protection of the manifest endpoint, where unauthenticated targeted requests can generate excessive server load, allowing attackers to degrade application performance and slow response times...

GHSA-CHX6-HX7R-MCP5 React Router: Unauthenticated Denial of Service via Inefficient Route Matching

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response...

PYSEC-2026-3490 NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode Summary When netlicensing-mcp is run in HTTP transport mode, the ApiKeyMiddleware fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler server.py:1427. The...