EUVD-2026-94385

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

CVE-2026-40022

camel-platform-http-main 非ルートコンテキストパスにおける認証バイパス（CVE-2026-40022） このプロジェクトは、Apache Camel の camel-platform-http-main コンポーネント（Camel main ランタイムの組み込み HTTP / 管理サーバー）における 認証バイパス を実証するもので、CVE-2026-40022 として追跡されています。認証が有効で、非ルートのコンテキストパス（例：/api や /admin）が設定されている場合、認証ハンドラーは正確なコンテキストパスのみをカバーするため、サブパス...

EUVD-2026-57010

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 /env, /loggers bypass API basic-auth...

EUVD-2026-81043

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without...

CVE-2026-92780

KnowStreaming through version 3.4.1 fails to enforce role-based access control on its REST API endpoints , specifically in the PermissionInterceptor component. Any authenticated user can call identity-management endpoints to create administrator accounts or grant themselves administrative privile...

CVE-2026-92780 KnowStreaming through 3.4.1 Missing Authorization on the REST API

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without...

CVE-2026-88959

Anchor CMS through 0.12.7 contains a privilege escalation vulnerability caused by missing role-based access control (RBAC) on admin user-management endpoints. Any authenticated user with editor or user roles can send POST requests directly to the admin/users/add or admin/users/edit endpoints to c...

PT-2026-85026

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL.toString.contains"/mgmt/". Tomcat returns getRequestURL un-decoded, while Spring MVC's...

EUVD-2026-67312

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account...

CVE-2026-18965

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account...

PT-2026-83302

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

CVE-2026-18965

PayRange API lacks proper authorization on its management endpoints, allowing verbose details of every device on the PayRange network to be publicly accessible, with or without an account. Per CISA advisory ICSA-26-237-04, successful exploitation enables a remote attacker (authenticated or unauth...

CVE-2026-18965 Missing Authorization in PayRange API

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account...

CVE-2026-18965 Missing Authorization in PayRange API

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the JWTAuthenticationConfigurer in components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java. An attacker can gain...

Mattermost Server 10.11.x < 10.11.22 / 11.7.x < 11.7.7 Multiple Vulnerabilities (MMSA-2026-00672, MMSA-2026-00675, MMSA-2026-00704)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00672, MMSA-2026-00675, MMSA-2026-00704 advisories. - Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin...

CVE-2026-73245

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245

Kestra, an open-source event-driven orchestration platform, prior to 2.0.0-rc6 exposed Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env to disclose resolved configuration and POST /loggers/{...

CVE-2026-73245: Missing Authentication for Critical Function

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...