CVE-2026-62253

The Homer telecom observability software is vulnerable to a complete authentication bypass in versions prior to 11.0.283 . The root cause is that both JWTMiddleware and JWTMiddlewareV4 functions (located in coordinator/handlers/auth.go and coordinator/handlers/auth_v4_helpers.go) are designed to ...

ChurchCRM - API Authentication Bypass via URL Injection Detection

ChurchCRM 7.1.0 contains an authentication bypass caused by improper API middleware URL handling in ChurchCRM/Slim/Middleware/AuthMiddleware.php, letting unauthenticated attackers access protected API endpoints, exploit requires crafted request URL with 'api/public !/usr/bin/env python3 -- coding...

CVE-2026-43885

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints e.g. userslist without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an...

HCL BigFix IVR security vulnerability

HCL BigFix IVR is a vulnerability fixing tool from HCL India. A security vulnerability exists in HCL BigFix IVR version 4.2 that stems from insufficient session expiration of the Web UI authentication component, which could lead to unauthorized access to protected API endpoints...

PT-2026-6480

OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials...