NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.
CVE-2026-92254 is a vulnerability in Watchdog Anti-Virus 1.8.640 through versions before 1.8.804 on Microsoft Windows. It involves missing authorization checks in the IOCTL handlers of the wsdkd.sys kernel driver, allowing local low-privileged attackers to delete arbitrary files with SYSTEM privileges. This bypasses NTFS access controls and can disable security products or destabilize the OS.
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/{id} and /pic/preview/{id} as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key lookup without ownership, organization, or permission checks. An unauthenticated caller who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations because the stored organization id is used only to locate the file rather than authorize the caller. This issue is fixed in version 1.7.4.
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.
IBM Guardium Data Protection version 12.2 contains a critical vulnerability due to missing authentication in the LoadBalancerServlet. This flaw allows unauthenticated users to perform privileged load-balancer operations, which can compromise system integrity and availability.
IBM Guardium Data Protection version 12.2 contains a critical vulnerability (CVE-2026-84075) where the ChangeTrackerServlet lacks proper authentication. This flaw allows a remote attacker to bypass security restrictions without any privileges or user interaction. The vulnerability has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.
IBM Guardium Data Protection version 12.2 contains a critical vulnerability (CVE-2026-82967) that allows unauthenticated remote attackers to bypass IP-based access controls and access the management interface. This authentication bypass flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.
IBM WebSphere Application Server versions 8.5 and 9.0 contain an authentication bypass vulnerability in the SOAP/JMX connector. This flaw allows unauthenticated network attackers to access a critical function without proper authentication. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily affecting confidentiality. No integrity or availability impacts are reported. There is no indication of public exploits or active exploitation in the wild. No patch or remediation information is currently provided.
A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/dependencies.py of the component FastAPI. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The reported GitHub issue was closed automatically due to inactivity.
Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to host.docker.internal while ToolHive API and MCP proxy endpoints are reachable without authentication. A malicious or compromised MCP server can use the Docker gateway to contact host-local services, other ToolHive-managed MCP proxies, or the ToolHive control plane without escaping the container. This access can expose data and logs, invoke sibling MCP tools, alter process or workload state, and disrupt services. ToolHive Studio additionally sends network_isolation as false and overrides the backend's secure isolation default. This issue is fixed in ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0.
A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.
CareCam CM2507 IP cameras have a vulnerability in their firmware version 251211.1507 where an insufficiently protected network maintenance mechanism can enable a remote debugging service. This service can be activated by an attacker on the same local network under certain device state conditions, potentially allowing unauthorized administrative access. The vulnerability is classified as CWE-306 and has a low CVSS score of 3.1.
CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.
NASA CryptoLib version 1.5.0 has an authentication downgrade vulnerability in its Telecommand receive path. The vulnerability arises because the receiver selects the Security Association (SA) based only on the SPI field in the incoming frame without verifying if the SA is authorized for the frame's GVCID. This flaw can allow unauthorized processing of frames, potentially compromising the security of telecommand communications.
CVE-2026-85889 is a critical vulnerability in Microsoft Azure AI Foundry where missing authentication for a critical function allows unauthorized attackers to elevate privileges over a network. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected service. Microsoft has issued an official fix for this vulnerability and manages remediation for this cloud-hosted service.
CVE-2026-54767 is a critical vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.5 contain an unauthenticated GET endpoint that allows remote attackers to perform destructive database truncation operations without authorization. The vulnerability arises because the endpoint's access is controlled only by a hardcoded key embedded in the public source code. Exploitation can permanently delete member and contributor records. This issue is fixed in version 3.8.5.
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive ContribuicaoLogController operations from authentication, and constructs a controller include path without canonical directory containment. An unauthenticated remote attacker can invoke getContribuicoesLogJSON, sincronizarStatus, registrarFaturas, and other sensitive methods to disclose contribution and donation records or trigger financial workflow operations. A traversal-shaped nomeClasse value can also cause require_once to include an accessible PHP or configuration file outside the intended controller directory, exposing source code, credentials, or other sensitive local data. This issue is fixed in version 3.8.5.