CVE-2026-84403 Botslab G980H Dashcams Missing Authentication for Critical Function

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device...

CVE-2026-88956 Botslab G980H Dashcams Missing Authentication for Critical Function

The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's...

CVE-2026-88956 Botslab G980H Dashcams Missing Authentication for Critical Function

The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's...

CVE-2026-88956

The Botslab G980H dash camera firmware is vulnerable to an authentication vulnerability involving the root account accessible via the device's UART interface . Because the account does not require a password, an unauthenticated attacker with physical access to the device can connect to the UART i...

CVE-2026-93354 Taskview Community Missing Authentication via OAuth Dynamic Client Registration

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

CVE-2026-93354

Versions of Taskview Community before 1.56.0 are vulnerable to a missing authentication flaw in the OAuth 2.0 Dynamic Client Registration endpoint. Because this endpoint is enabled by default without authentication, unauthenticated attackers can submit a POST request to obtain a client_id and cli...

CVE-2026-93354 Taskview Community Missing Authentication via OAuth Dynamic Client Registration

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

CVE-2026-93354 Taskview Community Missing Authentication via OAuth Dynamic Client Registration

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

EUVD-2026-86453

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

GHSA-X7QQ-23VW-7PFG social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...

social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...

GHSA-36F9-7RG5-CPF8 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

Reported by @echennells Eric Chennells. Migrated from public issue 191 to a private advisory. Affected: @bsv/wallet-toolbox / -client / -mobile. Verified in 2.1.21 and 2.1.21-parity-fix.2; the relevant code is the same at current HEAD Summary: When createAction runs against a remote StorageClient...

CVE-2026-86860

ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to extract instance data beyond what was intended, resulting in privilege escalation. ServiceNow...

CVE-2026-81455

Dell ThinOS 10, versions prior to SecurityAddon2605.10.2766T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-77321

TREK is a collaborative travel planner. Prior to 3.3.0, the gettripsummary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. A token granted only an unrelated...

CVE-2026-57440

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe...

EUVD-2026-86403

ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to extract instance data beyond what was intended, resulting in privilege escalation. ServiceNow...

CVE-2026-86860

The ServiceNow AI Platform contains a missing authorization vulnerability that could allow an unauthenticated user to extract instance data beyond intended limits, potentially leading to privilege escalation . ServiceNow has released security updates for hosted instances and provided updates for ...

WordPress Modula Image Gallery – Photo Grid & Video Gallery plugin <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure vulnerability

Missing Authorization to Unauthenticated Private Gallery Image Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Modula Image Gallery versions = 3.0.1...

CVE-2026-81455

Dell ThinOS 10, versions prior to SecurityAddon2605.10.2766T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...