CVE-2026-101073: Improper Authentication

A security flaw has been discovered in Netcore NR289-GE 1.4.5102. Impacted is an unknown function of the file /bin/boa of the component CGI Dispatcher. Performing a manipulation results in improper authentication. The attack may be initiated remotely. The exploit has been released to the public a...

CVE-2026-101916: Improper Certificate Validation

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-100886

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly availabl...

CVE-2026-100886 Seetong T8108/T8108P/T8116/T8232 Debug Service improper authentication

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly availabl...

CVE-2026-100886

A vulnerability exists in the Debug Service of Seetong devices, specifically models T8108, T8108P, T8116, and T8232 running version 4.6.1.4-build202604241011 . Manipulation of an unknown function within this component leads to improper authentication . This flaw can be triggered via a remote atta...

CVE-2017-7921-EXP

Exploit de CVE-2017-7921 Se descubrió un problema de autenticación inadecuada en dispositivos Hikvision. ​ La vulnerabilidad de autenticación inadecuada ocurre cuando una aplicación no autentica a los usuarios de manera adecuada o correcta. ​ Esto puede permitir que un usuario malintencionado...

Improper Authentication

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Improper Authentication via the password login flow in UsersRouter.js when a code-based auth adapter is in use. An attacker...

CVE-2017-7921

CVE-2017-7921 CVE-2017-7921 is a critical vulnerability CVSS score: 9.8 affecting multiple Hikvision IP camera and DVR models, first disclosed in 2017. It stems from an improper authentication flaw that allows unauthenticated remote attackers to bypass login mechanisms and gain unauthorized acces...

pocketbase-CVE-2026-44166

CVE-2026-44166: PocketBase OAuth2 Account Pre-Hijacking A PocketBase auth collection with OAuth2 enabled lets the client pass a createData object when it signs up. The email inside createData is never checked against the email the OAuth2 provider verified. Anyone with an account on a configured...

ColumbiaSoft DocumentLocator - Improper Authentication

Instances of ColumbiaSoft's Document Locator prior to version 7.2 SP4 and 2021.1 are vulnerable to an Improper Authentication/SSRF vulnerability. This template identifies vulnerable instances of the ColumbiaSoft Document Locater application by confirming external DNS interaction/lookups by...

SSL VPN Session Hijacking

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. id: CVE-2024-53704 info: name: SSL VPN Session Hijacking author: johnk3r severity: critical description: | An Improper Authentication vulnerability in the SSLVPN...

ZenML ZenML Server - Improper Authentication

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/usernameorid/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. id: CVE-2024-25723 info:...

CVE-2026-100886: Improper Authentication

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly availabl...

CVE-2026-101042: Improper Authentication

Parse Server is an open-source backend server. In versions = 9.0.0 = 8.0.2 8.6.91, the code-based authentication adapters GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo verify the client's authorization code with the external provider on signup and on...

CVE-2026-101050: Improper Authentication

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

CVE-2026-101049: Improper Authentication

Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials...

CVE-2026-100871: Improper Authentication

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

cve-2024-49039-task_scheduler_eop_reproduction

CVE-2024-49039: Vulnerabilidad de elevación de privilegios en el Programador de tareas de Windows Descripción general CVE-2024-49039 es una vulnerabilidad de elevación de privilegios EoP en el Programador de tareas de Windows que permite a un atacante autenticado escapar de la sandbox AppContaine...

CVE-2024-10511

CVE-2024-10511 CWE-287: Improper Authentication Summary Schneider Electric PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations PowerChute Serial Shutdown v1.2.0.301 and prior...

CP-PLUS-EZ-P21-CVE-2026-65893-65894

🔐 Análisis de seguridad de la cámara IP CP PLUS EZ-P21 CVE-2026-65893 CVE-2026-65894 Ejecución de código arbitrario y autenticación inadecuada – Cámara IP CP PLUS EZ-P21 Descripción general Este repositorio documenta dos vulnerabilidades de seguridad identificadas en la cámara IP CP PLUS EZ-P21 ,...