115727 matches found
CVE-2026-82930
The mH-DEVELOPER smart home module contains a vulnerability where the authorization middleware fails to verify tokens. This flaw leaves all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can exploit this to query endpoints, access system...
CVE-2026-82930 Missing Authentication in mH-DEVELOPER
mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...
Exploit for CVE-2026-100903
CVE-2026-100903 GEOritm Missing Authentication Descripti...
CVE-2026-82383
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...
CVE-2026-82377
Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...
EUVD-2026-88138
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...
CVE-2026-82383 Apache Roller: Anonymous setup action allows frontpage configuration tampering
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...
CVE-2026-82383 Apache Roller: Anonymous setup action allows frontpage configuration tampering
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...
CVE-2026-82383
Apache Roller version 6.1.5 is vulnerable to a missing authentication flaw in a critical function. An unauthenticated remote attacker can persistently change site-global configuration values, specifically the frontpage weblog selection , because the setup action remains anonymously reachable afte...
CVE-2026-82377
Apache Roller version 6.1.5 is vulnerable to a missing authorization flaw in the legacy XML-RPC Blogger and MetaWeblog APIs . While the handlers authenticate the caller, they fail to verify if the caller has specific permissions for the target weblog or entry. This allows an authenticated user to...
CVE-2026-82377 Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...
CVE-2026-82377 Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...
CVE-2026-84656
A flaw was found in Jenkins. A missing permission check allows attackers with 'Item/Read' permission on at least one job to bypass intended access restrictions. This enables them to read sensitive build parameter names and values from jobs they are not authorized to access, leading to information...
CVE-2026-101004
A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...
EUVD-2026-88096
The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The...
EUVD-2026-88090
A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...
CVE-2026-101004 notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication
A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...
CVE-2026-101004
A security vulnerability exists in notionnext-org NotionNext up to version 4.10.10 within the Authentication Guard component. The flaw resides in the cleanCache function of the pages/api/cache.js file, where manipulating the token argument leads to missing authentication . This allows for remote ...
CVE-2026-101004 notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication
A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...
