CVE-2026-102458

EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API...

CVE-2026-93462

Missing authentication for critical function vulnerability exists in baserCMS . If a remote unauthenticated attacker there is a possibility that sensitive information could be obtained...

CVE-2026-92873

Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node...

CVE-2026-92868

An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication...

CVE-2026-92873

The Pgpool-II software contains an incorrect implementation of an authentication algorithm . This vulnerability may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node . No specific exploitation details or remediation steps are provided in the documents.

CVE-2026-93462

A missing authentication for critical function vulnerability (CWE-306) exists in baserCMS . A remote unauthenticated attacker can exploit this flaw to obtain sensitive information . To remediate this issue, users should update the software to the latest version provided by the developer.

CVE-2026-92868

An improper certificate validation vulnerability exists in Pgpool-II . This flaw may allow an unauthenticated attacker to bypass client certificate authentication . While the vulnerability is documented, specific details regarding the affected versions, root cause, or available remediation are no...

CVE-2026-97196

The Liquid Web / StellarWP GiveWP WordPress plugin, versions up to and including 4.16.9 , is vulnerable to an Authentication Bypass due to an Improper Validation of Unsafe Equivalence in Input vulnerability. This flaw allows an attacker to bypass authentication mechanisms, potentially granting un...

EUVD-2026-89605

A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service...

CVE-2026-103057

AiSOC versions 5.1.0 before 12.0.0 are vulnerable to an authentication bypass in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push . This flaw allows attackers to post arbitrary events using spoofed tenant identifiers , enabling them to broadcast malicious...

EUVD-2026-89541

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

CVE-2026-103053

AiSOC versions 9.0.0 before 12.0.0 are vulnerable to an authentication bypass in the response-action API endpoints . This flaw occurs when AISOC_DEV_MODE is enabled and the AISOC_ACTIONS_SERVICE_TOKEN is empty within a default Docker Compose deployment. An unauthenticated attacker can exploit thi...

CVE-2026-76730

An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication...

CVE-2026-76731

An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain limited access to some data and to make limited changes...

CVE-2026-76725

A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could result in a complete bypass of security restrictions, potentially leadi...

CVE-2026-76726

An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain...

CVE-2026-100296

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2026-100291

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations...

EUVD-2026-89409

Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send...

CVE-2026-53988

Dockhand versions prior to 1.0.40 are vulnerable to an authentication bypass in the git webhook endpoints caused by a null webhook secret guard condition. This allows unauthenticated remote attackers to enumerate stack IDs and send unsigned webhook requests to trigger arbitrary stack redeployment...