CVE-2026-48952

Lack of escaping leads to an XSS vulnerability in the update list view of cominstaller...

EUVD-2026-42062

Lack of escaping leads to an XSS vulnerability in the generic image output layout...

[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`

ImpactAPIURLS is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks. ReferencesISSUEPATCH...

ROS-20260707-73-0003

The vulnerability of the user interface of the Zabbix monitoring system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code remotely...

PT-2026-56223

Name of the Vulnerable Software and Affected Versions Joomla! Core affected versions not specified Description Lack of escaping in the file management view of the com templates component leads to a Cross-Site Scripting XSS issue. XSS is a flaw that allows an attacker to inject malicious scripts...

ROS-20260706-73-0012

The vulnerability of the CREATE TYPE command in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL functions remotely...

ROS-20260706-73-0008

The vulnerability of the CREATE TYPE command in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL functions remotely...

SAP S/4HANA OData Service Data Compromise

The vulnerability of the OData service of the SAP S/4HANA software platform is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise the integrity of the protected information...

CGA-FQJ7-R2GH-WX4V

Bulletin has no description...

PT-2026-57493

The HTTP /rpc sessions method returned every attached session UUID without authentication, and the /rpc handler accepted an arbitrary session field with no ownership check. An anonymous caller could enumerate UUIDs and impersonate any authenticated session. "Attached" means sessions registered vi...

Zyxel GS1200 series Switch Authentication Bypass Information Disclosure

The vulnerability of Zyxel GS1200 series microprogrammed software devices is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information through a specially crafted HTTP request...

CVE-2026-10763: Undefined Security Weakness

PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server...

CVE-2026-35098: Improper Restriction of Excessive Authentication Attempts

KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient brute‑force attacks against user accounts. When combined with vulnerability CVE-2026-35097, where...

CVE-2026-22078 O+ Connect's lack of authentication for IPC channels led to a local privilege escalation vulnerability.

Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel...

CVE-2026-22078: Incorrect Privilege Assignment

Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel...

Microsoft Exchange Online Privilege Escalation

The vulnerability of Microsoft Exchange Online corporate email service is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

CVE-2026-48778

Notepad++ prior to 8.9.6.1 is affected by an RCE in config.xml: the value is read without validation and passed to ShellExecute when triggering File → Open Containing Folder → cmd, enabling attacker-controlled executable paths. The issue stems from NppXml::value() storing the value in _nppGUI._c...

EUVD-2026-39569

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead t...

Security Framework Component Data Compromise

The vulnerability of the Security Framework component of the Oracle WebCenter Portal is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2026-52595

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description WebSocket endpoints lack proper authentication mechanisms, which allows attackers to impersonate charging stations. This flaw can be exploited to gain unauthoriz...