PT-2026-86874

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts...

PT-2026-86667

A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation. Performing a manipulation of the argument position results in missing authentication. The attack may be initiated remotely. Th...

CVE-2026-86502: Missing Authentication for Critical Function

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts...

CVE-2026-86480: Missing Authentication for Critical Function

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges...

CVE-2026-86506: Missing Authentication for Critical Function

In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data...

CVE-2026-86486: Missing Authentication for Critical Function

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank...

CVE-2026-79645: Missing Authentication for Critical Function

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorize...

CVE-2026-78480: Missing Authentication for Critical Function

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorize...

CVE-2026-80132: Missing Authentication for Critical Function

ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized...

CVE-2026-76578: Missing Authentication for Critical Function

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...

CVE-2026-86293: Missing Authentication for Critical Function

A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the component Deletion Endpoint. Executing a manipulation of the argument ID can lead to missing authentication. The attack may be...

CVE-2026-86292: Missing Authentication for Critical Function

A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation. Performing a manipulation of the argument position results in missing authentication. The attack may be initiated remotely. Th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: etcd (UTSA-2022-001268)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-001268 advisory. In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS...

CVE-2026-86184

Lara Dashboard before 1.3.0 is affected by an authentication bypass in the screenshot-login route. When APP_ENV is not set to production, an unauthenticated attacker can request GET /screenshot-login/{email} with any registered email address to obtain a fully authenticated session. This grants ac...

CVE-2026-86184 Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APPENV is not production. Attackers can request the GET /screenshot-login/email endpoint with a registered emai...

CVE-2026-86121

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...

CVE-2026-86121

Cua computer-server (by Cua, GitHub: trycua/cua) versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all network interfaces by default. This allows an unauthenticated attacker to reach TCP port 8000 and execute arbitrary shell commands via ...

CVE-2026-86121: Missing Authentication for Critical Function

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...

CVE-2026-67277: Missing Authentication for Critical Function

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate...

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

Summary The OpenChoreo control-plane cluster-gateway exposes internal management APIs /api/proxy/, /api/exec/, /api/wirelogs/ that tunnel requests through to connected data planes' Kubernetes APIs, but the internal listener authenticates no caller. Its request validator permits mutating HTTP...