117882 matches found
PT-2026-102406
Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.1 Description A missing authentication issue exists in the DeliveryController checkDelivery endpoint. This allows unauthenticated attackers to retrieve shipment tracking information, including carrier names, waybill...
CVE-2026-101077: Missing Authentication for Critical Function
A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function processrequest of the component boatemp Handler. This manipulation causes missing authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contact...
CVE-2026-82930: Missing Authentication for Critical Function
mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...
CVE-2026-52748: Missing Authentication for Critical Function
The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthenticated remote attacker to trigger a configuration backup and retrieve it in a form encrypted by a device-specific key. Triggering this function renders the...
CVE-2026-101004: Missing Authentication for Critical Function
A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...
CVE-2026-89300: Missing Authorization
The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The...
CVE-2026-100903: Missing Authentication for Critical Function
A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is...
PT-2026-99776
Name of the Vulnerable Software and Affected Versions WP Verify API WordPress plugin version 1.0.0 Description An authorization check is missing in a REST route, which allows unauthenticated users to insert arbitrary data into the plugin database table. Additionally, this flaw enables the site to...
PT-2026-102404
Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.0 Description A missing authentication flaw exists in the 'PUT /user/updatePwd' endpoint. This allows unauthenticated attackers to reset the password of any storefront account by providing a target username in the...
CVE-2026-101000: Missing Authorization
A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the...
WS-2026-0077
OpenBao's sys/plugins/catalog update, delete and read handlers lacked a root-namespace check, so a privileged token scoped to a child namespace could register, modify or remove plugin catalog entries that are global to the whole server. Affects OpenBao 2.3.0-beta20250528 through 2.6.2 since...
CVE-2026-82377: Missing Authorization
Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...
Fedora 45 : suricata (2026-9cf326b4f4)
The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9cf326b4f4 advisory. upstream bugfix/security release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...
CVE-2026-86335: Missing Authorization
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests...
CVE-2026-93539: Missing Authentication for Critical Function
A vulnerability was discovered in Fleet's Git webhook receiver the gitjob webhook service. When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any...
PT-2026-99922
Name of the Vulnerable Software and Affected Versions MarcosCamara01 Ecommerce Template versions prior to commit ec97209 Description Missing authentication in the product cache revalidation Server Action allows a remote, unauthenticated attacker to force the expiration of the entire storefront...
CVE-2026-96538: Missing Authorization
WarehousePG WHPG 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability CWE-862 in the built-in server-side file functions pgfilewritetext,text,bool, pgfilerenametext,text,text, pgfileunlinktext, and pglogdirls. These functions are executable by any authenticated database role...
CVE-2026-100879
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...
EUVD-2026-88032
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...
