CVE-2026-103053 AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

CVE-2026-103053 AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

CVE-2026-103270: Missing Authentication for Critical Function

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

PT-2026-103067

A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information...

PT-2026-103080

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description Missing authentication allows unauthenticated remote attackers to obtain the plaintext passwords of other users through a specific API endpoint. Recommendations At the moment, there is ...

CVE-2026-102150: Missing Authentication for Critical Function

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...

PT-2026-103464

Name of the Vulnerable Software and Affected Versions Move 4K 12X versions prior to 0.0.98 Move 4K 20X versions prior to 0.1.33 Move 4K 30X versions prior to 2.1.17 Link 4K 12X versions prior to 0.0.99 Link 4K 20X versions prior to 0.1.37 Link 4K 30X versions prior to 2.1.18 Move SE 12X versions...

CVE-2026-102149: Missing Authentication for Critical Function

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where...

CVE-2026-102124: Missing Authentication for Critical Function

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured...

CVE-2026-46711: Missing Authentication for Critical Function

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/ , /archive/ without any authentication or origin check. Any...

CVE-2026-103053: Missing Authentication for Critical Function

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

CVE-2026-93462: Missing Authentication for Critical Function

A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information...

CVE-2026-102458: Missing Authentication for Critical Function

EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API...

CVE-2026-75969: Missing Authentication for Critical Function

Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified...

CVE-2026-102811

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

EUVD-2026-89111

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

CVE-2026-102811 Marmite through 0.4.2 Unauthenticated API Access via Development Server

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

CVE-2026-82277

A missing-authentication flaw CWE-306 was found in the Argo Rollouts dashboard. The dashboard binds to all network interfaces 0.0.0.0 and exposes mutating Rollout operations — including PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout — without any...

Exploit for Missing Authentication for Critical Function in Qualcomm Ar9380_Firmware

POCO M7 Plus SM6375 - Jailbreak Root Research Disclaime...

CVE-2026-86158

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...