CVE-2026-84249 IBM Guardium Data Protection is affected by vulnerability

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...

CVE-2026-107779

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false. Unauthenticated attackers can POST GLUESHELL, GLUEPYTHON, or GLUEPOWERSHELL job...

CVE-2026-104076

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers...

CVE-2026-107779

The Dromara Skyeye software contains a missing authentication vulnerability in the bundled xxl-job-admin component, specifically within the JobInfoController endpoints annotated with @PermissionLimit(limit = false). This flaw allows unauthenticated attackers to send a POST request to the /jobinfo...

CVE-2026-107779 Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false. Unauthenticated attackers can POST GLUESHELL, GLUEPYTHON, or GLUEPOWERSHELL job...

EUVD-2026-95257

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false. Unauthenticated attackers can POST GLUESHELL, GLUEPYTHON, or GLUEPOWERSHELL job...

CVE-2026-104076

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 are vulnerable to a missing authentication flaw in their REST API endpoints on port 8288 . Remote unauthenticated attackers can exploit this to read sensitive device information, including network configurations and fir...

CVE-2026-84272

IBM Guardium Data Protection versions 12.1 and 12.2.2 are vulnerable to a missing authentication flaw in the edge-controller component. An unauthenticated remote attacker can exploit this to execute arbitrary container images and seize control of managed edge clusters . No specific exploitation d...

CVE-2026-5724

Summary The Temporal frontend service does not enforce authentication on streaming gRPC RPCs. The streaming interceptor chain omits the authorization interceptor, allowing unauthenticated callers to access AdminService/StreamWorkflowReplicationMessages, a privileged admin-only endpoint that strea...

CVE-2026-34200

Nhost MCP Server: One-Click Infrastructure Compromise Official Advisory: This vulnerability was acknowledged and published by Nhost: GHSA-6c5x-3h35-vvw2 This repository documents a vulnerability in the Nhost Local MCP Server. The service lacks inbound authentication and implements a permissive CO...

CVE-2026-33017-Exploit

CVE-2026-33017 - Langflow Unauthenticated RCE / \ | | \ ^ / ||||| exec with no auth, no sandbox, no hope. Langflow chat.py - startflowbuild - buildgraphfromdata - Graph.frompayload - loading.py - eval.py createclass - validate.py prepareglobalscope - execcompiledcode - arbitrary code runs as the...

CVE-2026-39987

CVE-2026-39987 — Marimo Python Notebook Pre-Authenticated Remote Code Execution TL;DR A pre-authenticated remote code execution vulnerability in Marimo , an open-source Python notebook for data science and AI/ML. The terminal WebSocket endpoint /terminal/ws completely skips authentication...

CVE-2026-24061

CVE-2026-24061 Telnet NEW-ENVIRON authentication bypass vulnerability PoC. Build Windows MinGW: gcc -o exploit.exe exploit.c -lws232 Linux: gcc -o exploit exploit.c -lpthread Usage ./exploit port Example ./exploit 192.168.1.1 23 Disclaimer For authorized security testing only...

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE For educational and authorized security research purposes only. Description Pre-authenticated Remote Code Execution in Marimo = 0.20.4. The WebSocket endpoint /terminal/ws skips authentication validation, allowing an unauthenticated attacker to obtain a full...

CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication

CVE-2026-30824 — Flowise NVIDIA NIM Authentication Bypass Checker and Exploit A proof-of-concept checker and exploit for CVE-2026-30824 , a critical authentication bypass vulnerability in Flowise that exposes NVIDIA NIM API endpoints without authentication. Vulnerability Overview CVE-2026-30824 i...

smart-sketcher-upload

smART Sketcher 2.0 - Bluetooth Authentication Bypass CVE-2026-0842 | Missing Authentication on BLE Interface Overview The smART Sketcher 2.0 is a Bluetooth-enabled toy projector that lets kids trace images. It has no authentication on its Bluetooth connection - anyone within range can connect and...

CVE-2026-26418

CVE-2026-26418 Missing Authentication and Authorization in Web API Vulnerability Summary A missing authentication and authorization vulnerability was identified in the Web API layer of Tata Consultancy Services TCS – Cognix Recon Client v3.0. Certain exposed API endpoints did not enforce proper...

CVE-2026-47858

CVE-2026-47858 — Spring Tools "live information" mode unauthenticated JMX RCE PoC 中文 README | Advisory: Spring Security | CVE Record Vulnerability : Spring Tools for Eclipse ≤ 5.2.0 / VSCode·Cursor·Theia ≤ 2.2.0 start Spring Boot applications in live information mode enabled by default with JVM...

CVE-2026-39987

⚠️ CVE-2026-39987 — Shell sin autenticación en marimo 0.23.0 Una herramienta reactiva de cuadernos de Python dio a los atacantes una shell completa con una sola petición WebSocket. 📌 Resumen CVE-2026-39987 es una vulnerabilidad crítica de RCE sin autenticación previa en marimo — un popular cuadern...

360WFP_Exploit

360WFPExploit Una prueba de concepto PoC que demuestra el posible abuso de la interfaz del controlador WFP de 360 Security 360netmonx64wfp.sys, con el objetivo de verificar el riesgo de que las interfaces IOCTL sin autenticación del llamante puedan ser utilizadas indebidamente por programas de...