CVE-2026-67578: Missing Authentication for Critical Function

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...

CVE-2026-75465

The Maccms v10 v2026.1000.4055 software is vulnerable to an Incorrect Access Control issue in the /api.php/user/get_list endpoint. The interface fails to implement any authentication or authorization checks, allowing an unauthenticated remote attacker to send a crafted HTTP GET request. By manipu...

PT-2026-81348

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description The Jobs API in PraisonAI lacks authentication middleware, router-level dependencies, and per-route authorization checks. This allows any caller who can reach the jobs server to submit agent jobs...

phpMyFAQ register.php Bypass

The vulnerability of the register.php component in the phpMyFAQ web application is related to the lack of authentication when processing the security.enableRegistration parameter. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by sending a speciall...

CVE-2026-55528: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.authtoken but AgentServer.createapp does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when...

PT-2026-82016

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing databa...

PT-2026-81323

Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.6.34 through 4.6.57 Description In the praisonai serve agents command, the system fails to enforce authentication on public agent invocation endpoints even when an API key is provided via the --api-key flag. The create...

PT-2026-81328

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description An authentication bypass exists in the multi-agent teams system where the create agents app function fails to authenticate requests to the 'POST /agents' and 'POST /agents/agent name' endpoints...

PT-2026-81482

Name of the Vulnerable Software and Affected Versions Alluxio affected versions not specified Description The S3 REST proxy fails to verify AWS Signature Version 4 signatures when using the default configuration. This allows unauthenticated attackers to spoof user identity by extracting usernames...

PT-2026-81194

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...

CVE-2026-55534: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but createagentsapp does not authenticate POST /agents or POST /agents/agentname. A network caller can invoke configured agents without credentials even when an API key was...

PT-2026-81862

Name of the Vulnerable Software and Affected Versions Maccms version v2026.1000.4055 Description The '/api.php/user/get list' endpoint is subject to Incorrect Access Control, which occurs when an application fails to properly restrict access to sensitive data or functions. The interface does not...

CVE-2026-78434

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be...

CVE-2026-78434

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be...

CVE-2026-78434 Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be...

CVE-2026-78434 Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be...

CVE-2026-78434 Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be...

CVE-2026-78434

Faveo Helpdesk versions up to 2.0.3 contain a missing authentication flaw in the FormController::post_ticket_reply function within app/Http/Controllers/Client/helpdesk/FormController.php, specifically in the post-ticket-reply Endpoint . An unauthenticated remote attacker can exploit this to achie...

CVE-2026-78369

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

CVE-2026-78369

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...