CVE-2026-102503

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 are vulnerable to missing authentication and authorization in the /libp2p-http ingress server. Specifically, the StartIngressServer function in cmd/sam-node/node.go fails to verify Biscuit tokens or mesh enrollment, allowing...

CVE-2026-102503 Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)

Missing Authentication for Critical Function CWE-306 and Missing Authorization CWE-862 in the /libp2p-http ingress server StartIngressServer in cmd/sam-node/node.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass...

CVE-2026-102503 Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)

Missing Authentication for Critical Function CWE-306 and Missing Authorization CWE-862 in the /libp2p-http ingress server StartIngressServer in cmd/sam-node/node.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass...

CVE-2026-112143: Missing Authentication for Critical Function

A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The...

PT-2026-117322

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.3 Description An authentication bypass exists in the reaction API endpoint. The system fails to enforce content visibility controls, which allows unauthorized users to read reaction metadata from restricted...

CVE-2026-90910: Missing Authentication for Critical Function

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

PT-2026-117326

A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched...

PT-2026-117209

Name of the Vulnerable Software and Affected Versions Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 Description Missing authentication and authorization in the /libp2p-http ingress server, specifically within the StartIngressServer function in cmd/sam-node/node.go, allow ...

CVE-2026-102503: Missing Authentication for Critical Function

Missing Authentication for Critical Function CWE-306 and Missing Authorization CWE-862 in the /libp2p-http ingress server StartIngressServer in cmd/sam-node/node.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass...

CVE-2026-108771: Missing Authentication for Critical Function

Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: fro...

CVE-2026-112104: Missing Authentication for Critical Function

A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched...

CVE-2026-82166: Missing Authentication for Critical Function

Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2026-111999

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

EUVD-2026-103452

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

CVE-2026-111999 Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

CVE-2026-111999 Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

CVE-2026-111999

Versions 0.8.0 through 0.9.0 of Vanus are affected by a missing authentication vulnerability in the gateway CloudEvents HTTP receiver . This flaw allows unauthenticated remote attackers to bypass token authentication and authPublish checks by sending forged CloudEvents to the /namespaces/{ns}/eve...

CVE-2026-111870

A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. The attack can be initiated...

CVE-2026-111870 itsmeravitejak Online-Examination-System admin.php isAdmin missing authentication

A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. The attack can be initiated...

EUVD-2026-103381

A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. The attack can be initiated...