Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 / 12.0 / 12.1 < Security 2026 Update 4 Multiple Vulnerabilities

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, 11.5, 12.0, or 12.1 and is missing the Security 2026 Update 4 Patch. It is, therefore, affected by multiple vulnerabilities: - A missing authentication vulnerability exists in Esri Portal for ArcGIS that allows a...

PT-2026-116016

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id ...

PT-2026-116036

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...

PT-2026-116103

🚨 CVE-2026-111704 LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM...

CVE-2026-64959: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...

CVE-2026-105667: Missing Authentication for Critical Function

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...

CVE-2026-111322

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to...

CVE-2026-111312

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/id GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medic...

CVE-2026-111322 Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to...

CVE-2026-111322

Archon versions 0.2.13 through 0.11.1 are vulnerable to a missing authentication flaw in the /api/ control API *, which binds to 0.0.0.0 by default. An unauthenticated attacker with network access can send messages to the AI coding agent running with bypassPermissions . This allows the attacker t...

CVE-2026-111322 Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to...

CVE-2026-111312

The OpenHealth application (versions through 0.2.0 ) is vulnerable to a missing authentication and authorization flaw in the /api/health-data/[id] route. The GET , PATCH , and DELETE handlers fail to perform necessary session or authorId checks when querying records by ID. Consequently, an unauth...

CVE-2026-111312 OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/id GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medic...

CVE-2026-111312 OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/id GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medic...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to work without a challenge-response authentication model. This has been changed in versions 6.9.13-48 and...

CVE-2026-39997

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and...

CVE-2026-34006

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later...

EUVD-2026-101988

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and...

EUVD-2026-101974

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later...

CVE-2026-34006 Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later...