EUVD-2026-101988

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and...

EUVD-2026-101974

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later...

CVE-2026-34006 Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later...

CVE-2026-39997: Missing Authentication for Critical Function

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and...

CVE-2026-105038: Missing Authentication for Critical Function

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime...

CVE-2026-111322: Missing Authentication for Critical Function

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to...

PT-2026-115280

Name of the Vulnerable Software and Affected Versions Archon versions 0.2.13 through 0.11.1 Description Missing authentication allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agen...

PT-2026-115276

Name of the Vulnerable Software and Affected Versions OpenHealth versions prior to 0.2.1 Description Missing authentication and authorization in the '/api/health-data/id' GET, PATCH, and DELETE handlers allow unauthenticated attackers to access medical records. By knowing a HealthData record id, ...

PT-2026-114876

Name of the Vulnerable Software and Affected Versions sMedio DTCP MOVE versions prior to 1.4.5 Description A missing authentication for critical function allows remote attackers to gain unauthorized access to the system. Recommendations Update to sMedio DTCP MOVE version 1.4.5 or later...

CVE-2026-34006: Missing Authentication for Critical Function

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later...

CVE-2026-111312: Missing Authentication for Critical Function

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/id GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medic...

CVE-2026-64856

Prior to version 3.20.0 , the self-hosted file manager FileRise is vulnerable due to a missing authenticated-session guard on the /api/file/snippet.php endpoint. This allows unauthenticated requests to bypass the initial session check and reach ACL evaluation instead of receiving an immediate 401...

CVE-2026-64856 FileRise: Missing Authentication Guard on File Snippet Preview Endpoint

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL...

CVE-2026-64856 FileRise: Missing Authentication Guard on File Snippet Preview Endpoint

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL...

CVE-2026-110669

A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be...

EUVD-2026-101623

A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be...

CVE-2026-110669

A security vulnerability exists in cemtan sar2html version 4.0.0 . The flaw is located in the deleteHost/deleteRange/deleteAll functions within the sar2html.py file, leading to missing authentication . This vulnerability can be exploited remotely , potentially allowing unauthorized manipulation o...

CVE-2026-109439

Lantronix XPress-DR and XPress-DR-I CoBos-family firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718...

EUVD-2026-101337

Lantronix XPress-DR and XPress-DR-I CoBos-family firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718...

CVE-2026-110619

frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frp...