CVE-2026-82383 Apache Roller: Anonymous setup action allows frontpage configuration tampering

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...

CVE-2026-101004

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

EUVD-2026-88090

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-101004 notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-101004 notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-101004

A security vulnerability exists in notionnext-org NotionNext up to version 4.10.10 within the Authentication Guard component. The flaw resides in the cleanCache function of the pages/api/cache.js file, where manipulating the token argument leads to missing authentication . This allows for remote ...

CVE-2026-100903

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is...

CVE-2026-100903 ООО НПО Ритм GEOritm REST API obj-groups missing authentication

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is...

CVE-2026-100903

The GEOritm software by ООО НПО Ритм (versions up to 2.45.1 ) contains a missing authentication vulnerability within the REST API component. Specifically, manipulating the objectId argument in the /restapi/objects/obj-groups file allows for unauthorized remote access. The vendor has confirmed the...

CVE-2026-100903 ООО НПО Ритм GEOritm REST API obj-groups missing authentication

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is...

EUVD-2026-88070

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is...

CVE-2026-101077: Missing Authentication for Critical Function

A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function processrequest of the component boatemp Handler. This manipulation causes missing authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contact...

PT-2026-99922

Name of the Vulnerable Software and Affected Versions MarcosCamara01 Ecommerce Template versions prior to commit ec97209 Description Missing authentication in the product cache revalidation Server Action allows a remote, unauthenticated attacker to force the expiration of the entire storefront...

CVE-2026-49994: Missing Authentication for Critical Function

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-82930: Missing Authentication for Critical Function

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

CVE-2026-101004: Missing Authentication for Critical Function

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

PT-2026-102404

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.0 Description A missing authentication flaw exists in the 'PUT /user/updatePwd' endpoint. This allows unauthenticated attackers to reset the password of any storefront account by providing a target username in the...

CVE-2026-100903: Missing Authentication for Critical Function

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is...

CVE-2026-82383: Missing Authentication for Critical Function

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...

PT-2026-102406

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.1 Description A missing authentication issue exists in the DeliveryController checkDelivery endpoint. This allows unauthenticated attackers to retrieve shipment tracking information, including carrier names, waybill...