EUVD-2026-76060

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute...

EUVD-2026-76038

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-89176

WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network can easily spoof student or teacher endpoints. Impersonating a student can disrupt normal classroom operations, whereas...

CVE-2026-89176

WeenyGenius is a computer lab management system developed by Howyar Technologies that suffers from a Missing Authentication vulnerability. Unauthenticated attackers on the same network can spoof student or teacher endpoints. Impersonating a student can disrupt normal classroom operations, while i...

CVE-2026-89176 Howyar｜WeenyGenius - Missing Authentication

WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network can easily spoof student or teacher endpoints. Impersonating a student can disrupt normal classroom operations, whereas...

EUVD-2026-76003

WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network can easily spoof student or teacher endpoints. Impersonating a student can disrupt normal classroom operations, whereas...

PT-2026-89900

MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, o...

CVE-2026-89261: Missing Authentication for Critical Function

MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogusearch service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or...

PT-2026-90490

TRC analysis reveals attackers exploiting MikroTik RouterOS vulnerabilities to compromise network infrastructure and pivot across segments. Missing authentication flaws CVE-2024-67277 and command injection CVE-2024-86060 enable total device control. Runtime segmentation helps contain...

PT-2026-90491

TRC analysis reveals attackers exploiting MikroTik RouterOS vulnerabilities to compromise network infrastructure and pivot across segments. Missing authentication flaws CVE-2024-67277 and command injection CVE-2024-86060 enable total device control. Runtime segmentation helps contain...

PT-2026-90501

Name of the Vulnerable Software and Affected Versions Mousehole versions prior to 0.4.05 Description Mousehole is a background service used to update a seedbox IP for MyAnonamouse MAM and a web app for its management. The HTTP/WebSocket management boundary is accessible without application-layer...

CVE-2026-90449: Missing Authentication for Critical Function

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

PT-2026-89851

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute...

PT-2026-89799

Name of the Vulnerable Software and Affected Versions WeenyGenius affected versions not specified Description WeenyGenius, a computer lab management system developed by Howyar Technologies, contains a missing authentication flaw in its endpoint communication layer. This issue allows unauthenticat...

CVE-2026-89176: Missing Authentication for Critical Function

WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network can easily spoof student or teacher endpoints. Impersonating a student can disrupt normal classroom operations, whereas...

CVE-2026-89263: Missing Authentication for Critical Function

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

PT-2026-89902

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0

A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBETOPOLOGYV2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore, no credential...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the authentication process when the --auth-proxy option is enabled without also setting --auth-key. An attacker can gain unauthorized access by supplying any access key ID and signing...