CVE-2026-107607: Missing Authentication for Critical Function

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication...

CVE-2026-107605: Missing Authentication for Critical Function

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication...

CVE-2026-55183: Missing Authentication for Critical Function

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...

PT-2026-112046

Name of the Vulnerable Software and Affected Versions Windows SmartScreen affected versions not specified Description A missing authentication for a critical function allows an authorized attacker to perform local tampering, which can affect the system. Recommendations At the moment, there is no...

PT-2026-112466

Name of the Vulnerable Software and Affected Versions Windows Modern Device Management MDM affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to perform local tampering, which can affect the system. Recommendations At the momen...

CVE-2026-83656: Missing Authentication for Critical Function

Missing authentication for critical function in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

Microsoft Windows: CVE-2026-83656: Windows Modern Device Management (MDM) Tampering Vulnerability

Missing authentication for critical function in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

CVE-2026-110114: Missing Authentication for Critical Function

FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared...

CVE-2026-110128: Missing Authentication for Critical Function

fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names,...

PT-2026-111521

Name of the Vulnerable Software and Affected Versions NVIDIA AIStore for Linux affected versions not specified Description An authentication flaw exists in the token-revocation endpoint, allowing an unauthenticated remote attacker to submit crafted token-revocation lists. This may result in data...

CVE-2026-96858: Missing Authentication for Critical Function

Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally...

Microsoft Windows: CVE-2026-83715: Windows Error Reporting Tampering Vulnerability

Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally...

Microsoft Windows: CVE-2026-96183: Windows Health and Optimized Experiences Service Information Disclosure Vulnerability

Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally...

CVE-2026-96183: Missing Authentication for Critical Function

Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally...

CVE-2026-89309: Missing Authentication for Critical Function

The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method...

PT-2026-111720

Name of the Vulnerable Software and Affected Versions fuint versions prior to commit 4c4bc8a Description A missing authentication flaw allows unauthenticated attackers to retrieve order details of any member. By enumerating sequential orderId values at the '/clientApi/order/detail' endpoint witho...

CVE-2026-107606: Missing Authentication for Critical Function

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication...

CVE-2026-109570

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC...

CVE-2026-109571

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic 0x2A37. Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairin...

EUVD-2026-97894

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic 0x2A37. Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairin...