7169 matches found
CVE-2026-25703
NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information...
EUVD-2026-53297
NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information...
CVE-2026-25703
NeuVector up to version 5.4.9 potentially leaks information from the manager, specifically via the /network/graph API, due to missing authentication and cached data containing sensitive information. Affected component: NeuVector manager API surface; vulnerability arises from insufficient access c...
CVE-2026-25703 Potential information leakage from manager /network/graph API in NeuVector
NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information...
CVE-2026-71203
CVE-2026-71203 affects changedetection.io. The Spec resource at /api/v1/full-spec allows unauthenticated access because its get() method lacks both the @auth.check_token and @validate_openapi_request decorators, bypassing API key protection that guards other /api/v1/* endpoints. This enables retr...
CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema
changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...
CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema
changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...
PT-2026-72111
Name of the Vulnerable Software and Affected Versions PAX Technology Q80 affected versions not specified Description The XCB daemon lacks authentication, allowing network-adjacent attackers to disclose sensitive information and modify configurations. This flaw can be combined with other issues to...
CVE-2026-71241: Missing Authentication for Critical Function
Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. Because cardid values are sequential integers, the entire student database...
CVE-2026-25703: Missing Authentication for Critical Function
NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information...
CVE-2026-71214: Missing Authentication for Critical Function
The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...
CVE-2026-71289: Missing Authentication for Critical Function
The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. ":8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the CAM Configuration...
CVE-2026-71262: Missing Authentication for Critical Function
IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...
CVE-2026-71203: Missing Authentication for Critical Function
changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...
PT-2026-68089
Name of the Vulnerable Software and Affected Versions NeuVector versions prior to 5.5.0 Description Information may be leaked from the manager '/network/graph' API endpoint due to missing authentication and the presence of cached data containing sensitive information. Recommendations Update to...
(0Day) PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the XCB daemon. The issue results from the...
CVE-2026-18810
A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...
CVE-2026-18810 H3C NX15 networkSetup missing authentication
A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...