CVE-2026-22096

CVE-2026-22096 concerns a webserver running on port 8090 that does not require authentication, enabling sensitive information leakage (e.g., configured passwords) and file uploads via multiple endpoints. The Connected documents provide the same description across NVD and CVE records, with no vend...

CVE-2026-59801: Missing Authentication for Critical Function

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

PT-2026-57906

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.42 Description An unauthenticated information disclosure issue exists where remote attackers can retrieve plaintext API keys for all connected AI provider accounts. This occurs due to missing authentication...

PT-2026-59350

Vulnerability Type: Information Disclosure / Missing Authentication Severity: Medium Component: backend/open webui/routers/retrieval.py — get status GET / Affected Endpoint: GET /api/v1/retrieval/ Affected Version: Open WebUI main branch — confirmed unpatched through v0.9.2 Authentication Require...

PT-2026-59283

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint POST /memories. The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending...

CVE-2026-22096: Missing Authentication for Critical Function

The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints...

CVE-2026-15491

A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation causes missing authentication. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain...

CVE-2026-15491

The CVE-2026-15491 entry concerns RafyMrX TOKO-ONLINE-ROTI (up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99). The weakness is missing authentication in an unspecified part of the system. It can be exploited remotely over a network, with a low attack complexity and no required privileges. Th...

CVE-2026-15491 RafyMrX TOKO-ONLINE-ROTI missing authentication

A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation causes missing authentication. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain...

CVE-2026-15491: Missing Authentication for Critical Function

A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation causes missing authentication. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain...

Missing Authentication

SiYuan is vulnerable to Missing Authentication. The vulnerability is due to the kernel HTTP server unconditionally trusting all chrome-extension:// origins without authentication and the default empty AccessAuthCode on desktop installations, which allows an attacker controlling a malicious or...

CVE-2026-55884 Tilt: Missing authentication on the network-exposed Tilt HUD server

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can...

CVE-2026-55884 Tilt: Missing authentication on the network-exposed Tilt HUD server

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can...

Missing Authentication for Critical Function

Overview clauster is a Self-hosted web UI for spawning and managing Claude Code remote-control bridges on a remote host. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the authentication process. An attacker can gain unauthorized access to the...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the getDynamicIcon process. An attacker can retrieve sensitive database content by sending crafted requests to the unauthenticated endpoint with a valid block ID and specially crafted...

Exploit for Missing Authentication for Critical Function in Mcpjam Inspector

No d...

Missing Authentication for Critical Function

Overview @arikusi/deepseek-mcp-server is a MCP Server for DeepSeek API integration - enables Claude Code to use DeepSeek Chat and Reasoner models Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the POST /mcp endpoint due to the absence of...

CVE-2026-55884: Missing Authentication for Critical Function

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can...

CVE-2026-57475: Missing Authentication for Critical Function

Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access an...

Missing Authentication for Critical Function

Overview @mockoon/cli is a Mockoon's CLI. Deploy your mock APIs anywhere. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in admin-api.ts, which mounts the admin API on the same listener as user-defined mock routes enabled by default via...