UniFi Access - Broken Access Control

UniFi Access Application 3.3.22 through 3.4.31 contains a broken authentication caused by misconfiguration exposing management API without proper authentication, letting attackers on management network access management functions, exploit requires network access. id: CVE-2025-52665 info: name:...

CVE-2026-15706 Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

CVE-2026-15706

CVE-2026-15706 is a critical authentication bypass in the Management API of Baylan Smart Meter Management Application (BMS) by Baylan Measuring Instruments Industry and Trade Inc. The vulnerability stems from missing authentication for a critical function , allowing unauthenticated network access...

EUVD-2026-63165

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76761

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76761

CVE-2026-76761 is an OS command injection vulnerability in chenhg5 cc-connect (up to version 1.4.1). The flaw resides in the shellExecCommand function within core/engine.go , part of the Management API component. An attacker can remotely manipulate the exec argument to inject and execute arbitrar...

CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

GHSA-2QJ4-MMR9-4V2F vulnerabilities

Vulnerabilities for packages: pinot, seata, trino, thingsboard, management-api-for-apache-cassandra-4.1, management-api-for-apache-cassandra-5.0, pinot-fips, tez, celeborn, apache-hop-fips, hadoop-fips...

CVE-2026-59902 vulnerabilities

Vulnerabilities for packages: pinot, seata, trino, thingsboard, management-api-for-apache-cassandra-4.1, management-api-for-apache-cassandra-5.0, pinot-fips, tez, celeborn, apache-hop-fips, hadoop-fips...

GHSA-2QJ4-MMR9-4V2F vulnerabilities

Vulnerabilities for packages: celeborn, thingsboard, trino, tez, management-api-for-apache-cassandra-5.0...

CVE-2026-59903 vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, thingsboard, opensearch, trino, apicurio-registry, druid, wildfly, tez, infinispan, management-api-for-apache-cassandra-5.0, apache-pulsar, zipkin, akhq, keycloak, wavefront-proxy, neo4j...

CVE-2026-73507 vulnerabilities

Vulnerabilities for packages: apache-hop-fips, thingsboard, management-api-for-apache-cassandra-5.0, apache-hop, tez, seata, hadoop-fips...

CVE-2026-73507 vulnerabilities

Vulnerabilities for packages: tez, management-api-for-apache-cassandra-5.0, thingsboard...

CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification

Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...

CVE-2026-55986

CVE-2026-55986 concerns an issue where the Email Management API bypasses ManageCredentials feature restrictions. The connected sources do not specify affected product/version or root cause beyond this description. CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N yields a base score of 5.4 (Me...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-110)

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to...

CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...