CVE-2026-11387

CVE-2026-11387 — SMS Alert ≤ 3.9.5 ☆ 인증 없이 임의 비밀번호 재설정을 통한 권한 상승 ☆ === Beelze === 📋 취약점 정보 Field| Details ---|--- CVE ID| CVE-2026-11387 CVSS Score| 9.8 심각 CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type| 인증 누락 / OTP 우회 Plugin| SMS Alert – OTP Verification for WooCommerce sms-alert...

CVE-2026-94293 Missing authentication for critical function in the aas-edge-client REST API

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

CVE-2026-94293

The aas-edge-client REST API is vulnerable to a missing authentication flaw for critical functions. An unauthenticated remote attacker can perform PATCH requests to modify Asset Administration Shell submodel data and use GET endpoints to read all exposed data. No specific exploit details or remed...

CVE-2026-94293 Missing authentication for critical function in the aas-edge-client REST API

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

CVE-2026-39987-PoC

CVE-2026-39987 PoC 概要 Marimo = 0.20.4 は、/terminal/ws WebSocket エンドポイントにおける認証前 RCE の脆弱性の影響を受けます。 このエンドポイントはアプリケーションモードとターミナルサポートをチェックしますが、WebSocket 接続を受け入れる前に認証を検証しません 。その後、PTY シェルを作成するため、認証されていない攻撃者が Marimo プロセスの権限でコマンドを実行できるようになります。 根本原因 validateauth を呼び出す他の WebSocket...

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io: /api/v1/full-spec における認証の欠如により完全な OpenAPI スキーマが開示される 製品: dgtlmoon/changedetection.io — v0.55.7 ファイル: changedetectionio/api/Spec.py CWE: CWE-306 — 重要な機能に対する認証の欠如 CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — 5.3 中 CNA: Turan Security · CVE レコード 説明...

CVE-2026-105486

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-20253

Splunk Enterprise — CVE-2026-20253 트레이닝 랩 Splunk Enterprise 10.2.3 · PostgreSQL 복구 사이드카 · CWE-306 Missing Authentication for Critical Function 방어 교육을 위해 실제 권고를 모델링 한 공인된 자체 포함 재현입니다. Splunk의 독점 코드는 포함되지 않습니다. 이 저장소는 Vulhub/DVWA 스타일의 보안 훈련 랩입니다. Splunk Enterprise 10.2.3 의 충실한 모델을 구축하고 CVE-2026-202...

CVE-2026-105486

The OSSRS srs software (up to version 7.0-a1 ) contains a vulnerability in the System API component. Specifically, the systemAPI.Run function within the internal/proxy/api.go file lacks proper authentication, allowing for remote manipulation. Public exploits for this vulnerability are currently a...

EUVD-2026-92916

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-105486 OSSRS srs System API api.go systemAPI.Run missing authentication

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-105486 OSSRS srs System API api.go systemAPI.Run missing authentication

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

PT-2026-106307

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

PT-2026-106742

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro rpc port. Attackers can send forged requests with the force flag set to bypa...

PT-2026-106741

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove all and /api/mount to read cached KV data with use...

PT-2026-106773

Dell Container Storage Modules CSM, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service TenantService. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to...

CVE-2026-70411: Missing Authentication for Critical Function

Dell Container Storage Modules CSM, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service TenantService. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to...

CVE-2026-63692: Missing Authentication for Critical Function

Dell Container Storage Modules, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-63688: Missing Authentication for Critical Function

Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...

CVE-2026-48907

CVE-2026-48907 교육용 PoC ⚠️ 이 저장소는 교육 및 방어적 보안 목적으로만 제공됩니다. 소유한 시스템 또는 명시적으로 평가 권한이 부여된 시스템에서만 테스트하세요. 이 프로젝트를 제3자 시스템에 사용하지 마세요. 이 PoC는 CVE-2026-48907을 시연합니다. 이는 최대 2.9.99.4 버전까지의 Joomla Content Editor JCE에 영향을 주는 인증되지 않은 RCE 취약점입니다. 이것은 JCE의 프로필 가져오기 기능에서 누락된 인증 및 검증을 악용합니다, 이는 BIBIL0DAY의 원본 PoC와...