Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console

Juggle ships the H2 database web console enabled and reachable from non-localhost by default. No application-level authentication covers the /h2-console path, and the shipped default datasource credentials sa/juggle are known. An unauthenticated remote attacker can reach the console and, using th...

Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure

Flowise before 3.1.0 contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint, allowing unauthenticated remote attackers to retrieve an organization's complete SSO configuration including OAuth client secrets by providing an organizationId parameter. id: CVE-2026-56270...

Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure

Arcane 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access id: CVE-2026-42461 info: name: Arcane 1.18.0 - Unauthenticated...

CVE-2026-55450

CVE-2026-55450 — Langflow 보안 권고 인증되지 않은 파일 업로드 취약점 개요 CVE-2026-55450은 AI 기반 워크플로우를 구축하기 위한 오픈소스 플랫폼인 Langflow에 영향을 미치는 것으로 보고된 파일 업로드 취약점에 관한 것입니다. 노출된 업로드 엔드포인트는 인증되지 않은 파일 업로드를 허용할 수 있으며, 이로 인해 과도한 디스크 사용량과 내부 파일 시스템 경로 노출이 발생할 가능성이 있습니다. 이 저장소는 해당 취약점, 잠재적 영향, 탐지 참고 자료, 권장 완화 조치를 문서화합니다. 취약점 세...

CVE-2026-73296

🚨 CVE-2026-73296 - UFO-Vuln 💥 인증되지 않은 Mobile MCP 접근으로 Android 화면 데이터가 노출될 수 있으며, ADB를 통한 원격 UI 제어 기능이 제공될 수 있습니다. ⚠️ 보안 공지 이 저장소는 공인된 보안 연구, 취약점 검증, 방어적 테스트 및 통제된 실험실 환경에서만 사용하도록 제작되었습니다. 포함된 검사 도구는 비파괴적 인증 경계 검사 를 수행하도록 설계되었습니다. 다음 작업을 수행하지 않습니다 : 임의의 MCP 도구 실행 Android 기기 제어 실제 기기에 대한 ADB 명령 실행...

CVE-2026-76480

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, has conducted a comprehensive internal security review. This review resulted in software hardening releases...

CVE-2026-76480

The Cisco License On-Prem software (formerly known as Cisco Smart Software Manager On-Prem ) is affected by multiple vulnerabilities grouped under CVE-2026-76480 . These issues are characterized by improper authentication (CWE-306), specifically involving missing authentication for critical funct...

CVE-2026-76480 Cisco License On-Prem Security Hardening Release

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, has conducted a comprehensive internal security review. This review resulted in software hardening releases...

CVE-2026-76480 Cisco License On-Prem Security Hardening Release

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, has conducted a comprehensive internal security review. This review resulted in software hardening releases...

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Summary Both JWT middleware functions JWTMiddleware and JWTMiddlewareV4 immediately return nextc when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under /api/v1, /api/v3, and /api/v4 are completely unauthenticated. Details...

PT-2026-107611

Name of the Vulnerable Software and Affected Versions Cisco License On-Prem affected versions not specified Description Issues with improper authentication were identified in Cisco License On-Prem, formerly known as Cisco Smart Software Manager On-Prem. These issues fall under the Common Weakness...

CVE-2026-20253

Splunk Enterprise — CVE-2026-20253 トレーニングラボ Splunk Enterprise 10.2.3 · PostgreSQL リカバリーサイドカー · CWE-306 重要な機能に対する認証の欠如 認可された自己完結型の再現であり、防御教育のために実際のアドバイザリをモデル化 しています。Splunkのプロプライエタリコードは含まれていません。 このリポジトリは、Vulhub/DVWAスタイルのセキュリティトレーニングラボです。Splunk Enterprise 10.2.3 の忠実なモデルを立ち上げ、CVE-2026-20253...

CVE-2025-32433

🚨 CVE-2025-32433: Erlang/OTP SSH 서버의 인증 없는 원격 코드 실행 취약점 심각한 인증 전 원격 코드 실행 취약점 Erlang/OTP 내장 SSH 데몬의 심각한 결함으로, 인증되지 않은 원격 공격자 가 인증 완료 전에 조작된 SSH 연결 프로토콜 메시지를 전송하여 완전한 원격 코드 실행RCE을 달성할 수 있습니다. 📋 개요 CVE-2025-32433 은 Erlang/OTP 의 SSH 서버 구현에 영향을 미치는 심각한 취약점CVSS 10.0입니다. 공격자는 인증 전 단계 에서 SSH 메시지 번호 80...

Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution

Oracle E-Business Suite 12.2.3 through 12.2.11 is susceptible to remote code execution via the Oracle Web Applications Desktop Integrator product, Upload component. An attacker with HTTP network access can execute malware, obtain sensitive information, modify data, and/or gain full control over a...

Security Bulletin: IBM Guardium Data Protection is affected by vulnerability (CVE-2026-84249)

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-84249 DESCRIPTION: IBM Guardium Data Protection could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...

CVE-2026-20326 Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Missing Authentication for Critical Function

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20326

Cisco Nexus Dashboard contains a Missing Authentication for Critical Function vulnerability (CWE-306), identified during an internal security review and addressed in a software hardening release . The flaw allows a remote, unauthenticated attacker to perform critical functions over the network wi...

EUVD-2026-81094

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20326: Missing Authentication for Critical Function

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-90896

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...