113308 matches found
CVE-2026-106289
Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39...
CVE-2026-106369
Missing authorization in Translate in Google Chrome prior to 155.0.805...
CVE-2026-106271
Missing authorization in Workers in Google Chrome prior to 155.0.8059...
CVE-2026-106340
Missing authorization in CredentialProvider in Google Chrome on on Win...
CVE-2026-107206: Missing Authentication for Critical Function
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...
CVE-2025-70520
The websocket handler in Fanvil x7a firmware version 2.6.0.1182 fails to enforce proper authentication restrictions against sessionless users . This vulnerability allows unauthorized individuals to view device resources , including operational logs , or perform diagnostic requests . No specific r...
CVE-2026-27434: Missing Authorization
Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rentals: from n/a through 3.14.2...
CVE-2026-62179: Missing Authorization
PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependenc...
CVE-2026-62253: Missing Authentication for Critical Function
Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions JWTMiddleware and JWTMiddlewareV4 immediately return nextc when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under...
CVE-2026-104390: Missing Authorization
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27...
CVE-2026-96335: Missing Authorization
Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2...
CVE-2026-107352: Missing Authorization
Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...
PT-2026-107455
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27...
CVE-2026-107205: Missing Authentication for Critical Function
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...
CVE-2026-81535: Missing Authorization
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an...
CVE-2026-76268: Missing Authentication for Critical Function
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer REST Application Programming Interface API on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerabili...
CVE-2025-70516: Missing Authentication for Critical Function
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...
CVE-2026-76272: Missing Authorization
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user i...