PT-2026-58261

Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network...

PT-2026-58197

Name of the Vulnerable Software and Affected Versions Azure Spring Apps affected versions not specified Description Improper authentication allows an authorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that contain...

PT-2026-57975

Name of the Vulnerable Software and Affected Versions Apache Doris versions prior to 3.1.0 Description Certain HTTP REST administrative APIs in the Frontend FE were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform...

PT-2026-58266

Name of the Vulnerable Software and Affected Versions Windows Admin Center affected versions not specified Description Improper authentication allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no information about a newer version that contains a...

PT-2026-58347

Name of the Vulnerable Software and Affected Versions Windows RPC API affected versions not specified Description Improper authentication in the Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network. Remote Procedure Call RPC is a protocol that allows a...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via insufficient binding of JWT-backed API authentication to the organization context. An attacker can access sensitive information and perform unauthorized actions in another organization's context by replaying ...

Improper Authentication

Overview lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation Affected versions of this package are vulnerable to Improper Authentication via the file lightrag/api/config.py that uses a default JWT secret "lightrag-jwt-default-secret" when the TOKENSECRET environment variabl...

CVE-2026-15557

CVE-2026-15557 affects waooAI waoowaoo up to version 0.4.1. The vulnerability resides in the Internal Task Header Handler’s API-auth logic (functions getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, requireProjectAuthLight in src/lib/api-auth.ts). Malicious manipulatio...

CVE-2026-15557 waooAI waoowaoo Internal Task Header api-auth.ts requireProjectAuthLight improper authentication

A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This...

CVE-2026-15542

A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentication. The manipulation leads to improper authentication. The attack can be initiated remotely. The pull request to fix this iss...

CVE-2026-15542 will-moss Isaiah Websocket Connection Authentication main.go improper authentication

A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentication. The manipulation leads to improper authentication. The attack can be initiated remotely. The pull request to fix this iss...

CVE-2026-15542

This CVE affects will-moss Isaiah up to version 1.36.9, specifically the Websocket Connection Authentication component (file app/main.go). The underlying issue is in an unknown function that leads to improper authentication, with the attack described as remote. A fix is not yet merged; the pull r...

CVE-2026-15542 will-moss Isaiah Websocket Connection Authentication main.go improper authentication

A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentication. The manipulation leads to improper authentication. The attack can be initiated remotely. The pull request to fix this iss...

BIT-NEXTCLOUD-2022-24885 Improper Authentication in Nextcloud Android Files

Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextcloud app on an Android device by repeatedly reopening the app. Version 3.19.1 contains a fix for the problem. There are currently no known...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the auto-linking process by email, as the external identity provider does not verify ownership of the email address before linking accounts. An attacker can gain unauthorized access to a victim's local account...

Improper Authentication

Overview prowler is a Prowler is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI,...

Improper Authentication

Overview github.com/nats-io/nats-server/v2/server is an A simple, secure and performant communications system for digital systems, services and devices. Affected versions of this package are vulnerable to Improper Authentication in the parser fast path for inter-server connections, which applies ...

Improper Authentication

Overview github.com/nats-io/nats-server/server is an A simple, secure and performant communications system for digital systems, services and devices. Affected versions of this package are vulnerable to Improper Authentication in the parser fast path for inter-server connections, which applies a...

CVE-2026-9695

An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server...

CVE-2026-9695

DELMIA Apriso (releases 2020–2026) has an Improper Authentication vulnerability that could allow an attacker to gain privileged access to the server. CVSS v3.1 base score 9.8 (CRITICAL), vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No exploit details or remediation are provided in the supplied do...