OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and does not bind enrollment to locals.user.id. An unauthenticated attacker who knows the public tenant ID and the target staff email can use the public booking bootstrap and GET /api/tenants/[id]/appointments/staff-public-keys to obtain candidate userId values. The attacker first causes UserService.addAdditionalPasskey to store a controlled public key for a candidate userId, then attempts login with the target email; the login check compares verificationResult.userId with the email-resolved account and reveals whether the injected credential belongs to that target. Repeating this injection-before-login sequence identifies the matching userId, and the normal login endpoint accepts the attacker's assertion for the stored key and creates a STAFF session. The session can expose tenant data and reveal TENANT_ADMIN identifiers for further takeover; GLOBAL_ADMIN accounts are not reachable through this tenant-scoped path. A hijacked TENANT_ADMIN can modify or delete tenant resources and key shares, potentially making appointment data permanently undecryptable and taking booking services offline. This issue is fixed in version 1.1.1.
Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authenticating a client. An unauthenticated remote caller who can reach the intended tunnel deployment can therefore call /mcp and use vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire vault. Optional PKCE does not prevent an attacker-initiated flow, and unauthenticated /oauth/register also exposes a client_credentials path by returning the configured VAULT_OAUTH_CLIENT_SECRET. This issue is fixed in version 0.2.0.
CVE-2026-54504 is a vulnerability in andrea9293's mcp-documentation-server versions 1.13.0 up to but not including 1.13.1. The server's Web UI binds its document-management API to all network interfaces without authentication, allowing network-reachable attackers to access, modify, and delete documents without credentials. This issue is fixed in version 1.13.1.
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport requests to /mcp that omit x-netlicensing-api-key, Authorization: Bearer, and the apikey query parameter pass through ApiKeyMiddleware in src/netlicensing_mcp/server.py without authentication. The downstream api_key_ctx in src/netlicensing_mcp/client.py then falls back to the operator's NETLICENSING_API_KEY and authenticates upstream NetLicensing REST API calls under the operator account. An unauthenticated attacker can invoke MCP tools to enumerate products, licenses, licensees, and transactions, create or modify licensing objects, perform validations, and execute destructive delete operations. The issue affects HTTP deployments configured with a server-side key and does not require user interaction. This issue is fixed in version 0.1.6.
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
Dell OpenManage Server Administrator Managed Node for Windows versions prior to 11.1.0.3 contains a vulnerability due to missing authentication for a critical function. This flaw allows an unauthenticated remote attacker to potentially execute code remotely. The vulnerability is identified as CWE-306 and carries a high severity rating with a CVSS score of 8.1. A patch is available in version 11.1.0.3 to address this issue.
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service functionality may be possible.
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.
CVE-2026-50604 is a medium severity vulnerability in the Acer Agent Service used by NitroSense and PredatorSense. The vulnerability arises because the socket handshake process does not enforce authentication before granting access, potentially allowing unauthorized connections to access restricted functionality. The affected versions are those up to and including 1.2.110.2. There is no indication of known exploits in the wild or an available patch at this time.
CVE-2026-61594 is a critical vulnerability in djust versions prior to 1.0.7 where WebSocket transport bypasses standard Django authorization mechanisms. This allows anonymous or under-privileged clients to mount views and dispatch handlers over WebSocket that should be protected, including admin functions. The issue arises because authorization is checked via a custom method that does not enforce Django's usual access controls on WebSocket connections. The vulnerability is fixed in djust 1.0.7 by enforcing Django AccessMixin checks on all transports and introducing startup checks for unsafe auth patterns.
CVE-2026-92808 is a critical server-side request forgery (SSRF) vulnerability in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated attacker can make the server send HTTP requests to arbitrary destinations, including internal services that are normally inaccessible externally. One such internal service exposes sensitive server configuration and credentials without authentication, relying on the request originating locally. Exploiting this, an attacker can retrieve stored credentials and gain administrative access, leading to full compromise of the server and its services. Altium 365 cloud deployments are not affected as the vulnerable endpoint is disabled in cloud mode.
Control iD iDSecure versions prior to 4.8.3.0 contain an unauthenticated denial of service vulnerability. The /api/license/restartService endpoint can be accessed without authentication and triggers a service restart. An attacker can repeatedly invoke this endpoint to cause continuous service restarts, making the service unavailable.
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_handler`). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only `DEBUG`. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely. This issue is fixed in djust 1.0.7. The localhost restriction is enforced in-view on every observability endpoint (no longer dependent on a separately-installed middleware), and `eval_handler` is restricted; gated requests receive a non-disclosing response. As a workaround, ensure `DEBUG=False` in production, and do not expose the observability endpoints to untrusted networks.
CVE-2026-73173 is a high-severity vulnerability in Advantech EKI-1242IEIMS firmware version 1.06.01 and earlier. It involves missing authentication for critical functions in the edgserver management protocol, allowing remote unauthenticated attackers to perform sensitive device-management actions such as network reconfiguration, reboot, reset, and firmware upgrade via TCP port 5058.
WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi passphrase, and technical device information.This issue has been fixed in firmware version 1.1.0.651412
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
CVE-2026-68070 is a high-severity vulnerability in Digital Watchdog VMAX A1 G4 DVR devices. The issue arises from missing authentication on a critical function, which could allow an attacker to execute commands as root by passing received bytes directly to a system command. This vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability. No affected versions or patch information are provided in the available data.
CVE-2026-68953 is an authentication bypass vulnerability in the Digital Watchdog VMAX A1 G4 DVR. It allows unauthenticated remote attackers to send crafted HTTP(S) requests to disclose sensitive device information, including administrator credentials in plaintext. The vulnerability has a medium severity with a CVSS score of 6.5. No affected versions or patch information are provided.
A Broken Access Control vulnerability in NIAEFEUP's tts-be backend prior to version 2.1.0 allows remote attackers to bypass authorization checks by chaining unauthenticated API endpoints. This enables enumeration and extraction of sensitive Personally Identifiable Information (PII) including full names, student IDs, class schedules, and photos. The issue was fixed in version 2.1.0.