CVE-2026-94455

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

EUVD-2026-84547

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-94455 Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-94455: Missing Authentication for Critical Function

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

Huawei eCNS280_TD and ESE620X vESS out-of-bounds read vulnerability

Huawei eCNS280TD is a core network device for Huawei's wireless broadband trunking system. Huawei ESE620X vESS is a virtual enterprise service controller from Huawei, China. Huawei eCNS280TD and ESE620X vESS are vulnerable to an out-of-bounds read vulnerability. An attacker can exploit this...