CVE-2026-90620 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

CVE-2026-90620 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

CVE-2026-90620 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

CVE-2026-90620

0x4m4 HexStrike AI is affected by a missing authentication vulnerability in the API Command Endpoint (file hexstrike_server.py), allowing remote attackers to exploit it with no prior privileges. The affected range extends up to commit d689933ff579d839c676c82b231f8e98326c5f04; no specific version ...

SAP NetWeaver Application Server ABAP Auth Bypass

The vulnerability of SAP NetWeaver Application Server ABAP software integration platforms is related to the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to compromise the integrity and accessibility of protected information from a remote location...

SAP Solution Manager ST-PI Disclosure

The vulnerability of the functional module of the SAP Solution Manager SAP Solution Tools Plug-In ST-PI is related to the absence of an authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose sensitive information...

CVE-2026-12763: Missing Authentication for Critical Function

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component...

CVE-2026-54246: Missing Authentication for Critical Function

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/zone, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in...

CVE-2026-90944: Missing Authentication for Critical Function

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with an...

CVE-2026-57128: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

CVE-2026-57125: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agentyaml, and the approve field can mark executecommand as YAML-approved before @requireapproval checks critical tools. This...

CVE-2026-57123: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.runsse and launchtoolsmcpserver bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable...

CVE-2026-90938: Missing Authentication for Critical Function

LangBot's plugin runtime pip package langbotplugin through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 /plugin/ws whose authentication is gated on plugindebugkey, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose which...

CVE-2026-82787: Missing Authentication for Critical Function

Missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a remote attacker without authentication...

CVE-2026-82784: Missing Authentication for Critical Function

Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. An attacker may execute a REST API without authentication, which could allow the attacker to retrieve I/O values and/or control the output...

CVE-2026-90620: Missing Authentication for Critical Function

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

PT-2026-91034

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrike server.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

CVE-2026-59178: Missing Authentication for Critical Function

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

RFC modules in developing Information Disclosure

The vulnerability of RFC software modules for developing and executing applications in the ABAP SAP NetWeaver Application Server ABAP environment is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to disclose the protected information...

PT-2026-91091

Name of the Vulnerable Software and Affected Versions Contec CPSL-08P1EN versions prior to 2.3.1.0 Description A missing authentication for critical function issue exists in the web settings function of the device. A remote attacker with network access to the management service can operate the...