CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

PT-2026-72111

Name of the Vulnerable Software and Affected Versions PAX Technology Q80 affected versions not specified Description The XCB daemon lacks authentication, allowing network-adjacent attackers to disclose sensitive information and modify configurations. This flaw can be combined with other issues to...

CVE-2026-71289: Missing Authentication for Critical Function

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. ":8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the CAM Configuration...

CVE-2026-25703: Missing Authentication for Critical Function

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information...

PT-2026-68089

Name of the Vulnerable Software and Affected Versions NeuVector versions prior to 5.5.0 Description Information may be leaked from the manager '/network/graph' API endpoint due to missing authentication and the presence of cached data containing sensitive information. Recommendations Update to...

CVE-2026-71214: Missing Authentication for Critical Function

The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...

(0Day) PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the XCB daemon. The issue results from the...

CVE-2026-71241: Missing Authentication for Critical Function

Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. Because cardid values are sequential integers, the entire student database...

CVE-2026-71203: Missing Authentication for Critical Function

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

CVE-2026-71262: Missing Authentication for Critical Function

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

CVE-2026-18810 H3C NX15 networkSetup missing authentication

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...

CVE-2026-18810

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...

CVE-2026-69110

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

CVE-2026-24079

Technical details are not publicly available in the provided documents. The available descriptions only mention a cryptographic issue during processing of registration requests with malformed or missing authentication parameters. Monitor for updates.

EUVD-2026-52732

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...

CVE-2026-24079 Missing Authentication for Critical Function in Data Modem

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...

CVE-2026-24079

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...

CVE-2026-24079 Missing Authentication for Critical Function in Data Modem

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...

CVE-2026-63455: Missing Authentication for Critical Function

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...

PT-2026-67746

Name of the Vulnerable Software and Affected Versions OpenCode Studio versions prior to 2.4.4 Description Missing authentication allows remote attackers to read arbitrary files within the temp and static/music directories. This is achieved by accessing the 'GET /api/tmp/:tmpFile' and 'GET...