SAP HANA 访问控制错误漏洞

SAP HANA is a high-performance real-time data analytics platform from Germany's SAP SAP. The platform provides data query functionality to support users to query and analyze real-time business data. An access control error vulnerability exists in SAP HANA version 2.0 that stems from a lack of...

kgateway 安全漏洞

kgateway is a cloud-native API gateway and AI gateway open-sourced by kgateway-dev. A security vulnerability exists in kgateway version 2.0.4 and earlier and versions 2.1.0-agw-cel-rbac through 2.1.0-rc.2, which stems from a lack of authentication and could lead to unauthorized clients obtaining...

The vulnerability of the UEFI microprogramming software in embedded platforms for artificial intelligence from NVIDIA, the Jetson Orin Series and Jetson Xavier Series, allows a hacker to trigger a system failure.

The vulnerability of the UEFI microprogramming system in embedded platforms for artificial intelligence, such as NVIDIA Jetson Orin Series and NVIDIA Jetson Xavier Series, is related to the absence of authentication. Exploiting this vulnerability can allow a malicious actor to cause service...

Missing Authentication

Overview Affected versions of this package are vulnerable to Missing Authentication in the xDS interface. An attacker can access sensitive configuration data, including certificate information, backend service details, routing rules, and cluster metadata, by connecting to the exposed port without...

GHSA-4766-X535-JW3R kgateway is missing xDS authorization

Summary The xDS interface in Kgateway versions 2.0.0 through 2.0.4 lacks authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster...

CVE-2025-61956 Missing Authentication for Critical Function in Radiometrics VizAir

Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and misleading air traffic control ATC and pilots...

PT-2025-45013

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.71.0 Description lakeFS is a tool that transforms object storage into Git-like repositories. Versions 1.69.0 and below lack authentication for the /api/v1/usage-report/summary endpoint, allowing unauthorized access t...

CVE-2025-59461 API does not require authentication

A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services...

CVE-2025-59461

CVE-2025-59461 is an externally exploitable issue described as a remote, unauthenticated access via an unauthenticated C++ API that can disclose/modify sensitive data and disrupt services. Connected docs associate the vulnerability with the SICK TLOC100-100 product and reflect ER/Red Hat/NVD entr...

CVE-2025-62169 OctoPrint-SpoolManager Plugin APIs do not enforce authentication

OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks...

The vulnerability of the Radiflow iSAP Smart Collector, a platform for data collection, monitoring, and analysis in industrial automation and industrial security systems, lies in the lack of authentication for critical functions. This allows attackers to gain access to all system settings, modify configurations, and execute arbitrary code.

The vulnerability of the data collection, monitoring, and analysis platform in industrial automation and industrial security systems, Radiflow iSAP Smart Collector, is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to gain acce...

CVE-2025-11942 70mai X200 Pairing missing authentication

A flaw has been found in 70mai X200 up to 20251010. Affected is an unknown function of the component Pairing. Executing manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early abo...

WSO2 API Manager和WSO2 API Control Plane 安全漏洞

WSO2 API Manager and WSO2 API Control Plane are products of WSO2, Inc. WSO2 API Manager is an API lifecycle management solution and WSO2 API Control Plane is a control panel. A security vulnerability exists in WSO2 API Manager and WSO2 API Control Plane that stems from a lack of authentication an...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from the lack of authentication procedures, which allow unauthorized users to gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the absence of authentication procedures. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2025-59403

The Flock Safety Android Collins application aka com.flocksafety.android.collins 6.35.31 for Android lacks authentication. It is responsible for the camera feed on Falcon, Sparrow, and Bravo devices, but exposes administrative API endpoints on port 8080 without authentication. Endpoints include b...

EUVD-2025-28804

Malicious code in bioql PyPI...

EUVD-2025-30385

Malicious code in bioql PyPI...

EUVD-2025-28757

Malicious code in bioql PyPI...

CVE-2025-11130

Summary : CVE-2025-11130 affects iHongRen pptp-vpn on macOS, specifically the XPC Service component’s file HelpTool/HelperTool.m. The vulnerability resides in the function shouldAcceptNewConnection, which allows a local attacker to bypass authentication due to missing authentication checks. Publi...

The vulnerability in the web-server-based VPN microprogramming system of Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to compromise the confidentiality and integrity of protected information.

The vulnerability of Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD VPN microprogramming devices lies in the absence of authentication. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of protected information by...