Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure

Flowise before 3.1.0 contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint, allowing unauthenticated remote attackers to retrieve an organization's complete SSO configuration including OAuth client secrets by providing an organizationId parameter. id: CVE-2026-56270...

Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure

Arcane 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access id: CVE-2026-42461 info: name: Arcane 1.18.0 - Unauthenticated...

Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console

Juggle ships the H2 database web console enabled and reachable from non-localhost by default. No application-level authentication covers the /h2-console path, and the shipped default datasource credentials sa/juggle are known. An unauthenticated remote attacker can reach the console and, using th...

CVE-2026-73296

🚨 CVE-2026-73296 - UFO-Vuln 💥 Unauthenticated Mobile MCP access can expose Android screen data and provide remote UI-control capabilities through ADB. ⚠️ Security Notice This repository is intended for authorized security research, vulnerability validation, defensive testing, and controlled...

CVE-2026-20253

Splunk Enterprise — CVE-2026-20253 Training Lab Splunk Enterprise 10.2.3 · PostgreSQL recovery sidecar · CWE-306 Missing Authentication for Critical Function An authorized, self-contained reproduction that models the real advisory for defensive education. It does not ship Splunk's proprietary cod...

CVE-2025-32433

🚨 CVE-2025-32433: Unauthenticated RCE in Erlang/OTP SSH Server Critical Pre-Authentication Remote Code Execution Vulnerability A severe flaw in the Erlang/OTP built-in SSH daemon allows unauthenticated remote attackers to achieve full remote code execution RCE by sending crafted SSH connection...

Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution

Oracle E-Business Suite 12.2.3 through 12.2.11 is susceptible to remote code execution via the Oracle Web Applications Desktop Integrator product, Upload component. An attacker with HTTP network access can execute malware, obtain sensitive information, modify data, and/or gain full control over a...

Security Bulletin: IBM Guardium Data Protection is affected by vulnerability (CVE-2026-84249)

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-84249 DESCRIPTION: IBM Guardium Data Protection could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...

EUVD-2026-81094

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20326

Cisco Nexus Dashboard contains a Missing Authentication for Critical Function vulnerability (CWE-306), identified during an internal security review and addressed in a software hardening release . The flaw allows a remote, unauthenticated attacker to perform critical functions over the network wi...

CVE-2026-20326 Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Missing Authentication for Critical Function

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20326: Missing Authentication for Critical Function

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-90896

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...

CVE-2026-90896

CVE-2026-90896 is a Missing Authentication for Critical Function (CWE-306) in the MarcosCamara01 Ecommerce Template before commit 91e273c . The GET /api/stripe/checkout_sessions endpoint (in src/app/api/stripe/checkout_sessions/route.ts) calls stripe.checkout.sessions.retrieve() and returns the f...

CVE-2026-90896 Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...

CVE-2026-90896: Missing Authentication for Critical Function

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...

PT-2026-91735

Name of the Vulnerable Software and Affected Versions MarcosCamara01 Ecommerce Template versions prior to commit 91e273c Description Missing authentication in the checkout session lookup handler allows a remote, unauthenticated attacker to retrieve full session objects. By providing a valid Strip...

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain,...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 — Marimo Pre-Authentication RCE !CVEhttps:/...

CVE-2026-20357

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...