CVE-2026-107824: Missing Authentication for Critical Function

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...

Kibana 9.2.x / 9.3.x < 9.4.0 Missing Authorization (ESA-2026-191)

The version of Kibana installed on the remote host is 9.2.0 through 9.3.8 inclusive. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-191 advisory. - Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly...

Fedora 43 : barman (2026-82691b59d6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-82691b59d6 advisory. Update to 3.20.1. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

CVE-2026-107813: Missing Authorization

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user...

PT-2026-108773

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway SCG Policy Manager versions prior to 5.34.00.16 Description Missing authorization allows a low privileged attacker with remote access to potentially elevate their privileges. Recommendations Update Dell Secure Conne...

PT-2026-108880

Name of the Vulnerable Software and Affected Versions Envira Gallery Lite versions prior to 1.16.2 Description An authorization flaw exists in the gallery conversion REST endpoint. The endpoint verifies if a user can edit the source post but fails to check if they have the necessary permissions t...

PT-2026-108886

Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1...

PT-2026-108889

Name of the Vulnerable Software and Affected Versions Before After Image Comparison – Image comparison for WP versions prior to 1.1.22 Description An issue exists where missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Upda...

PT-2026-108858

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

PT-2026-108871

Name of the Vulnerable Software and Affected Versions Livees Checkout WordPress plugin versions prior to 7.0.3 Description The order confirmation page fails to perform capability, nonce, or order-key checks before processing request parameters. This allows unauthenticated users to modify the stat...

CVE-2026-104116: Missing Authorization

A missing authorization check in the illumos zones statistics daemon zonestatd allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsdserver in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the...

CVE-2026-85479: Missing Authentication for Critical Function

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it...

CVE-2026-105281: Missing Authentication for Critical Function

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system...

CVE-2026-62028: Missing Authorization

Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through...

CVE-2026-86851: Missing Authorization

The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and...

CVE-2026-62042: Missing Authorization

Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8...

CVE-2026-39779: Missing Authorization

Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0...

CVE-2026-97075: Missing Authorization

Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rocket: from n/a before 3.23.5...

PT-2026-108924

A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt door.c does not require the solaris.network.interface.config...

CVE-2026-62040: Missing Authorization

Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1...