CVE-2026-76157: Missing Authentication for Critical Function

Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...

CVE-2026-49217 Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...

CVE-2026-49217 Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987.py This python script exploit the vulnerable ma...

CVE-2026-18265

OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OSNEXUS QuantaStor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2026-18265 OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability

OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OSNEXUS QuantaStor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2026-18265

The vulnerability is in the configuration of Kapacitor within OSNEXUS QuantaStor, where missing authentication on a network-accessible endpoint allows unauthenticated attackers to execute arbitrary code as root (CVSS 9.8). Affected versions are not specified and no fix or patch version is availab...

EUVD-2026-63483

OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OSNEXUS QuantaStor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2026-18265 OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability

OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OSNEXUS QuantaStor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2026-15706 Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

EUVD-2026-63349

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

EUVD-2026-62920

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer REST API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prio...

PT-2026-79509

Name of the Vulnerable Software and Affected Versions Conekta Payment Gateway versions prior to 6.2.2 Description The plugin fails to verify the authenticity of incoming payment gateway webhook notifications. Additionally, it does not bind confirmed payments to the targeted order or verify the...

Missing Authentication for Critical Function

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the monitor endpoint, which does not validate incomi...

CVE-2026-77644: Missing Authentication for Critical Function

A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability WRR Enterprise Edition...

CVE-2025-52182: Missing Authentication for Critical Function

The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability...

CVE-2026-55642: Missing Authentication for Critical Function

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

CVE-2026-15706: Missing Authentication for Critical Function

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

PT-2026-79004

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

PT-2026-79517

Name of the Vulnerable Software and Affected Versions Social Login & Sharing buttons with Analytics By SoClever versions prior to 1.2.1 Description The plugin fails to perform authentication, authorization, or nonce checks in a publicly accessible login handler. This allows unauthenticated...