CVE-2026-111660

The waynboot-mall software (through version 2.0.0 ) is vulnerable to a missing authentication flaw (CWE-306) within the /callback/order/unpaid endpoint. This vulnerability allows unauthenticated attackers to cancel any member's pending orders by submitting predictable orderSn values, which are co...

EUVD-2026-103082

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...

CVE-2026-111659

Versions of Waynboot-mall through 2.0.0 are vulnerable to an unauthenticated order forgery due to a missing authentication vulnerability in the internal /callback/order/submit message-queue callback. Attackers can submit arbitrary userId , addressId , and cart ids within the order JSON to perform...

CVE-2026-111659 Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit

Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders...

CVE-2026-111653 53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when ISSAAS is true, attackers can enumerate sequential...

EUVD-2026-103075

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when ISSAAS is true, attackers can enumerate sequential...

CVE-2026-111653 53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when ISSAAS is true, attackers can enumerate sequential...

CVE-2026-111653

The 53AIHub application (versions through 0.5.3 ) is vulnerable to a missing authentication flaw in the /api/enterprises/:id endpoint. The root cause is that the UpdateEnterprise function only enforces authentication checks when the IS_SAAS flag is true. Consequently, unauthenticated attackers ca...

CVE-2026-111650 ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,...

CVE-2026-111650 ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,...

EUVD-2026-103072

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,...

CVE-2026-111650

ChronoFrame versions through 1.0.0 are vulnerable to a missing authentication flaw in the server/api/wizard/ handlers. An unauthenticated attacker can exploit this by sending a POST request to /api/wizard/storage, enabling them to reconfigure existing instances. This allows for the activation of ...

CVE-2026-111644

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the getcurrentuser dependency. Attackers can read audit logs with login IPs, server...

CVE-2026-111644 Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the getcurrentuser dependency. Attackers can read audit logs with login IPs, server...

EUVD-2026-103066

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the getcurrentuser dependency. Attackers can read audit logs with login IPs, server...

CVE-2026-111644 Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the getcurrentuser dependency. Attackers can read audit logs with login IPs, server...

CVE-2026-111644

Misaka Danmu Server versions through 2.8.9 are affected by a missing authentication vulnerability (CWE-306) located under the /api/ui routes. The root cause is the lack of the get_current_user dependency on specific endpoints, including audit, diagnostics, data-check, scan-index, and health route...

CVE-2026-111637 NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...

EUVD-2026-103059

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...

CVE-2026-111637

NexoPOS versions through 6.2.4 are vulnerable to an unauthenticated transaction disclosure flaw via the /api/fields/{resource}/{identifier} endpoint. The root cause is a missing authentication vulnerability where attackers can bypass the nexopos.read.transactions permission. By requesting transac...