CWE-306: Missing Authentication vulnerabilities

CVE-2026-102143 is a vulnerability in Kiteworks Email Protection Gateway where an unauthenticated attacker can write a file with attacker-controlled content to the appliance filesystem via an administrative upload handler lacking proper authentication. This flaw does not directly allow code execution, as that would require an additional vulnerability to place the file in an executable location. The issue affects versions prior to 9.5.1.

CVE-2026-102144 is a resource exhaustion vulnerability in Kiteworks Email Protection Gateway that allows an unauthenticated remote attacker to repeatedly trigger an expensive server-side operation, causing a partial denial of service. The vulnerability is due to missing authentication for a critical function. It affects versions from 0 up to but not including 9.5.1. The CVSS score is 5.3 (medium severity). No known exploits are reported in the wild and no patch information is provided.

CVE-2026-102150 is a vulnerability in Kiteworks Secure Data Forms where a critical function in the Advanced Forms component is accessible without authentication. This allows an unauthenticated attacker to perform a limited set of internal service operations on the platform. However, the vulnerability does not allow access to user accounts, stored files, or form submissions. The affected versions are from 9.3.0 up to but not including 9.5.1. The vulnerability has a CVSS score of 7.2, indicating high severity.

CVE-2026-102149 is a critical vulnerability in Kiteworks Email Protection Gateway where the system does not properly restrict certificate assignment to user accounts. This flaw allows an attacker to associate a certificate with another user's account, potentially compromising the confidentiality and integrity of encrypted emails. If certificate-based login is enabled, unauthorized access to the affected account may also be possible.

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/<path>, /archive/<dir>) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated _instances.internal TXT record, every other sm-ws-* machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches.

CVE-2026-75969 is a critical vulnerability affecting PTZOptics cameras and their Firmware Upgrade Tool. It involves missing authentication in the firmware update mechanism, allowing unauthenticated users to install modified firmware without administrator credentials. This affects multiple PTZOptics camera models and versions prior to specified firmware releases. The vulnerability has a high CVSS score of 9.1, indicating severe risk.

Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through 2026-09-29.

EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.

Apache DolphinScheduler versions before 3.4.3 contain a vulnerability in the /datasources/unauth-datasource endpoint that fails to properly enforce authorization. Authenticated users can access information about data sources they should not be authorized to view, potentially exposing sensitive configuration and metadata. This issue is fixed in version 3.4.3.

Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets are designed to perform specific functions within production environment depending on how the Asset Suite application is configured.

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production environment.

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.

CVE-2026-86158 is a high-severity vulnerability in Progress Software's Telerik Fiddler Everywhere version 1.0.0 up to but not including 8.2.0. It involves missing authentication in the local .NET backend component (Fiddler.WebUi), allowing a local unauthenticated attacker to mint OAuth tokens and access the machine-in-the-middle root certificate via unauthenticated localhost HTTP and SignalR RPC channels.

CVE-2026-49994 is a critical vulnerability in dannymcc bluehood prior to version 0.7.1. When authentication is enabled, only HTML page handlers enforced session validation, while API endpoints under /api/* did not check authentication. This allowed a network attacker with access to the dashboard port to read Bluetooth tracking data and modify application state without a session cookie. The issue is fixed in version 0.7.1.

CVE-2026-91154 is a vulnerability in the MarcosCamara01 Ecommerce Template that allows unauthenticated attackers to invoke a critical server action to forcibly expire the entire product cache. This occurs because the revalidateProducts function lacks authentication checks and is exposed publicly via a client component, enabling attackers to repeatedly disable caching and degrade storefront availability by forcing database reads on every request.

A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for.  This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.

The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthenticated remote attacker to trigger a configuration backup and retrieve it in a form encrypted by a device-specific key. Triggering this function renders the router inoperable for a substantial period of time.  This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to manipulate building automation devices. This issue was fixed in version 3.0.30

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check. No optional feature or non-default configuration is required; the result can redirect or break the site's public frontpage, with administrative recovery available. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which restricts the write to global administrators.