CVE-2026-104106: Missing Authentication for Critical Function

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no...

CVE-2026-109969: Missing Authentication for Critical Function

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...

CVE-2026-71854: Missing Authentication for Critical Function

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the /api/player/ lessons endpoints can be called without authentication, and they trust a client-supplied...

CVE-2026-110616: Missing Authentication for Critical Function

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ management API because the authtoken field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback...

PT-2026-114058

Name of the Vulnerable Software and Affected Versions NullHub versions prior to 2026.5.29 Description An authentication bypass exists in the management API endpoint /api/ because the auth token field defaults to null and is never assigned. Unauthenticated attackers sending requests without...

CVE-2026-97793

Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally...

CVE-2026-96183

Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally...

CVE-2026-85884

Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally...

CVE-2026-83715

Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally...

CVE-2026-83656

Missing authentication for critical function in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

CVE-2026-70580

Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally...

CVE-2026-62879

Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally...

CVE-2026-107606

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication...

CVE-2026-107607

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication...

CVE-2026-107605

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication...

CVE-2026-85884

The Windows Health and Optimized Experiences Service is vulnerable to a privilege escalation flaw due to missing authentication for a critical function (CWE-306). An authorized attacker can exploit this to elevate privileges locally on the affected system. While the CVSS 3.1 score is 7.8 (High) ,...

CVE-2026-62879

A missing authentication vulnerability in Windows SmartScreen (CWE-306) allows an authorized attacker to perform tampering locally . The vulnerability impacts the integrity of the system by enabling unauthorized modifications to critical functions. No specific exploit details or in-the-wild explo...

CVE-2026-96313

A missing authentication flaw in Windows Push Notifications allows an authorized attacker to perform a local privilege escalation . The root cause is identified as CWE-307 (Missing Authentication for Critical Function). The vulnerability has a High severity base score of 7.0, indicating significa...

CVE-2026-83715

The Windows Error Reporting service is vulnerable to a Missing Authentication for Critical Function (CWE-306) flaw. This vulnerability allows an authorized attacker to perform tampering locally on the affected system. The CVSS 3.1 base score is 7.1 (High) , with local access and low complexity re...

CVE-2026-83654

A local elevation of privilege vulnerability exists in Windows Modern Device Management (MDM) due to missing authentication for critical functions (CWE-306). An authorized attacker can exploit this flaw to gain higher privileges on the system. The vulnerability has a HIGH base severity score of 7...