CVE-2026-90504 vvbbnn00 WARP-Clash-API authorized missing authentication

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRETKEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclos...

CVE-2026-90504

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRETKEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclos...

EUVD-2026-76977

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRETKEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclos...

CVE-2026-90504 vvbbnn00 WARP-Clash-API authorized missing authentication

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRETKEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclos...

CVE-2026-90504

CVE-2026-90504 affects the vvbbnn00 WARP-Clash-API project, specifically the authorized function , where manipulation of the SECRET_KEY argument results in missing authentication . The vulnerability is exploitable remotely with no privileges or user interaction required, yielding low impact on co...

CVE-2026-90579: Missing Authentication for Critical Function

A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function authorizehttpkey of the file core/cat/factory/customauthhandler.py. The manipulation of the argument userid leads to missing authentication. The attack may be initiated remotely. The exploit h...

CVE-2026-90524: Missing Authentication for Critical Function

A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unknown function of the component Update Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated...

CVE-2026-90513: Missing Authentication for Critical Function

A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument...

CVE-2026-90504: Missing Authentication for Critical Function

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRETKEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclos...

PT-2026-90831

A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument...

PT-2026-90950

Name of the Vulnerable Software and Affected Versions cheshire-cat-ai versions prior to 1.9.3 Description An issue exists where the manipulation of the user id argument in the authorize http key function within the core/cat/factory/custom auth handler.py file leads to missing authentication. This...

PT-2026-90820

Name of the Vulnerable Software and Affected Versions vvbbnn00 WARP-Clash-API versions up to c7bf2360073959861219b422e51ae86411051b46 Description A remote attack is possible due to missing authentication in the authorized function. This occurs when the SECRET KEY argument is manipulated. This iss...

PT-2026-90861

A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unknown function of the component Update Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated...

PT-2026-90961

Name of the Vulnerable Software and Affected Versions GenieWords versions 1.5.27 through 1.5.34 Description Lack of authorization checks on certain REST API and AJAX actions allows unauthenticated users to overwrite plugin configuration. Additionally, the software decodes stored values before...

CVE-2026-90541

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu nam...

CVE-2026-90543

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via...

CVE-2026-90539

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

EUVD-2026-76865

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, allowing unauthenticated attackers to read chapter names from password-protected videos. Attackers can query the endpoint with a video ID...

CVE-2026-90543 WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via...

CVE-2026-90543 WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via...