58562 matches found
CVE-2026-76601
Fabrik is a Joomla extension developed by fabrikar.com. In versions prior to 4.7.2 , the order plugin did not perform any access checks, allowing unauthenticated row reordering of data. An attacker can exploit this over the network without credentials or user interaction to alter the ordering of ...
CVE-2026-56380
AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through...
EUVD-2026-64265
WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery...
CVE-2026-77002
The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators...
EUVD-2026-64224
The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...
CVE-2026-77002 SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass
The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators...
EUVD-2026-64227
The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators...
CVE-2026-16612 FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...
EUVD-2026-64217
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...
CVE-2026-48050
Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/ via app.Usepprof.New in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before...
CVE-2026-48050 Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS
Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/ via app.Usepprof.New in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before...
CVE-2026-48050 Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS
Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/ via app.Usepprof.New in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before...
CVE-2026-48050
Arc (an open SQL-native time-series database for telemetry) versions prior to 26.06.1 expose Go's net/http/pprof debug endpoints at /debug/pprof/* without authentication. The root cause is that /debug/pprof is added to PublicPrefixes in cmd/arc/main.go, causing the auth middleware to short-circui...
CVE-2026-34949
Combodo iTop versions prior to 3.2.3 are affected by an unauthenticated file deletion vulnerability. An attacker with no credentials can delete the .readonly file, which is created during the setup process to prevent users from performing write actions. Removing this file effectively disables the...
CVE-2026-53497 CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)
CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...
EUVD-2026-64172
CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...
CVE-2026-69228
There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource not user content that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3...
EUVD-2026-64156
There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource not user content that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3...
CVE-2026-69228
CVE-2026-69228 is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior. A remote, unauthenticated attacker can access a specific resource that should require authentication; the documents clarify this does not expose user content. The CVSS 3.1 score is 5.3 (Med...
CVE-2026-69228 missing authentication vulnerability in Esri Portal for ArcGIS
There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource not user content that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3...