CVE-2026-105170 kishor-23 food-waste-management-system Admin Signup signup.php missing authentication

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected is an unknown function of the file admin/signup.php of the component Admin Signup. This manipulation of the argument sign causes...

CVE-2026-73678-PoC

CVE-2026-73678 — MindsDB Minds Platform 未認証RCE（CVSS 10.0） CVSS 10.0（緊急） · CWE-94 / CWE-306 · GHSA-jcxw-h8ph-pxpv · VulnCheck 概要 Minds Platform（mindsdb/mindshub のオープンソースバックエンド。旧称 mindsdb/minds-platform）は、POST /api/v1/responses/（OpenAI互換のResponses API、ポート 26866 ）を一切の認証なしで 公開しています。認証ミドルウェアは存在しません —...

CVE-2025-3605

🚀 CVE-2025-3605 익스플로잇 가이드 🛡️ 취약점 요약 WordPress용 Frontend Login and Registration Blocks 플러그인버전 = 1.0.7은 계정 탈취를 통한 권한 상승 에 취약합니다. 이 문제는 flrblocksusersettingshandleajaxcallback 함수를 통해 이메일과 같은 민감한 정보를 업데이트할 때 플러그인이 사용자 신원을 검증하지 않기 때문에 발생합니다. ✅ 영향: 인증되지 않은 공격자가 관리자의 이메일을 변경하고, "비밀번호 찾기" 절차를 트리거하여 관리자...

CVE-2026-105210

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210

ZITADEL versions 3.x before 3.4.15 and 4.x before 4.17.1 are vulnerable to a missing authentication flaw in the hosted Login V1 UI . The root cause is that second-factor enrollment and initialization handlers process requests on an identify-only session before the primary factor is verified. An a...

CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

EUVD-2026-92103

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-8732

⚔️ CVE-2026-8732 WP Maps Pro ≤ 6.1.0 — 인증되지 않은 권한 상승 8단계 자동화 익스플로잇 | 멀티프로세싱 + Asyncio | 관리자 생성 검증 🎯 취약점 정보 WordPress 플러그인 WP Maps Pro 버전 ≤ 6.1.0에는 인증되지 않은 권한 상승 취약점이 있습니다. 자격 증명 없이도 공격자는 관리자 계정을 만들고 사이트를 장악할 수 있습니다. 이 취약점은 FlipperCode 벤더의 지원 팀을 위해 설계된 "임시 접근Temporary Access" 기능에서 비롯되었지만, 적절한 보호 없이...

CVE-2026-8732

CVE-2026-8732 — WP Maps Pro ≤ 6.1.0 ♡ 인증되지 않은 권한 상승을 통한 관리자 계정 생성 ♡ === shadow ♡ & friska === 📋 취약점 정보 필드| 세부사항 ---|--- CVE ID| CVE-2026-8732 CVSS 점수| 9.8 심각 CVSS 벡터| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 유형| 중요 기능에 대한 인증 누락 플러그인| WP Maps Pro wp-google-map-gold 영향 받는 버전| 모든 버전 ≤ 6.1.0 패치 버...

CVE-2026-85706

CVE-2026-85706: GitLab CE/EE の未認証任意ローカルファイル読み取り CVE-2026-85706 は、GitLab CE/EE の Repository Commits API および Repository Files API における重大なパストラバーサル / 認証欠如の問題です。未認証の攻撃者がサーバーに任意のファイルを読み取らせ、その内容をエラーチャネル経由で取得できます。CVSS 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N。 GitLab の公式タイトルは 「Path Traversal...

papercut-toolkit

PaperCut CVE-2026-81578 + CVE-2026-82078 防御ツールキット チェーンされた 事前認証リモートコード実行 の脆弱性に対する PaperCut の曝露を確認・理解するための 防御用 ツールキットです: CVE-2026-81578 — 重要な機能に対する認証の欠如 CWE-306。リモートからの未認証リクエストが、アクセス検証が完了する前に管理バックエンドのアクションをトリガーできます。 CVE-2026-82078 —...

PT-2026-104634

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

PT-2026-104659

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected is an unknown function of the file admin/signup.php of the component Admin Signup. This manipulation of the argument sign causes...

CVE-2026-105207: Missing Authentication for Critical Function

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...

CVE-2024-41713POC

CVE-2024-41713POC Mitel MiCollab 기업 협업 플랫폼의 임의 파일 읽기 취약점CVE-2024-41713은 Mitel MiCollab 소프트웨어의 NuPoint 통합 메시징NPM 구성 요소에 인증 우회 취약점이 존재하고 입력 검증이 부족하여, 인증되지 않은 원격 공격자가 이 취약점을 이용해 경로 순회 공격을 수행할 수 있습니다. 성공적으로 악용될 경우 사용자 데이터 및 시스템 구성에 대한 무단 액세스, 파괴 또는 삭제로 이어질 수 있습니다. 영향 범위: version MiCollab 9.8 SP2...

CVE-2026-100903

CVE-2026-100903 GEOritm 認証欠如 説明 : GEO.RITM ソフトウェアの REST API における POST /restapi/objects/obj-groups メソッドの脆弱性は、関数を実行する前の認証の欠如に関連しています。 影響 :...

CVE-2026-105105

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker ait-server in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command a...

EUVD-2026-92014

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker ait-server in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command a...