CVE-2026-69674 is a vulnerability in Microsoft Windows 10 Version 1809 and later versions involving missing authentication for a critical function in Windows Modern Device Management (MDM). This flaw allows an authorized local attacker to bypass a security feature. The issue has been officially fixed in multiple Windows 10 builds.
CVE-2026-69321 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds where the Windows Power Dependency Coordinator lacks proper authentication for a critical function. This flaw allows an authorized local attacker to perform tampering actions. The vulnerability has a medium severity with a CVSS score of 5.5 and has been officially fixed in multiple Windows 10 builds.
CVE-2026-83991 is a vulnerability in Microsoft Windows 10 Version 1809 affecting the Cloud Files Mini Filter Driver. It involves missing authentication for a critical function, allowing an authorized local attacker to perform tampering. The issue has been assigned a CVSS 3.1 score of 5.5, indicating medium severity. Microsoft has released official fixes for all affected versions.
CVE-2026-69554 is a vulnerability in Microsoft Windows 10 Version 1607 and other specified versions where missing authentication for a critical function in the Windows Search Component allows an authorized local attacker to perform tampering. The flaw affects multiple Windows 10 builds and some Windows 8 versions. Microsoft has issued official fixes for all affected versions.
CVE-2026-69528 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving missing authentication for a critical function in the Windows Shell. This flaw allows a locally authorized attacker to elevate privileges without user interaction. The vulnerability affects multiple builds of Windows 11 23H2 prior to specific fixed versions. Microsoft has released official patches to address this issue.
CVE-2026-69415 is a vulnerability in Microsoft Windows 10 Version 1607 and related versions where a missing authentication check in the Windows DHCP Server allows an authorized attacker to elevate privileges over a network. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. An official fix is available from Microsoft.
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device.
Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session.
Refer to the '
Security Update for ASUS Control Center Express Agent ' section on the ASUS Security Advisory for more information.
JetBrains GoLand versions before 2026.2.2.1 contain a vulnerability where the GoLand profiler's injected pprof server lacks authentication, exposing profiling data. This vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). It has a medium severity with a CVSS score of 5.9. No official patch or remediation details are provided in the input data.
In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts
CVE-2026-86486 is a low-severity vulnerability in JetBrains YouTrack before version 2026.2.18634. The issue involves the generic VCS webhook handler failing open when its secret is blank, which may lead to limited integrity impact. No confidentiality or availability impacts are reported.
Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions prior to 5.36.00.16 and 5.36.00.00 respectively contain a vulnerability where critical functions lack proper authentication. This flaw allows an unauthenticated remote attacker to potentially gain unauthorized access. The vulnerability is identified as CWE-306: Missing Authentication for Critical Function. It has a high severity with a CVSS score of 8.2.
Dell Secure Connect Gateway (SCG) 5.0 Application versions prior to 5.36.00.00 and Appliance versions prior to 5.36.00.16 contain a vulnerability due to missing authentication for a critical function. This flaw allows an unauthenticated remote attacker to potentially cause a denial of service condition. The vulnerability has a high severity rating with a CVSS score of 7.5. No official patch or remediation details are provided in the available data.
Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 contain a vulnerability due to missing authentication for a critical function. This flaw allows an unauthenticated remote attacker to potentially gain unauthorized access. The vulnerability is rated high severity with a CVSS score of 8.1, indicating significant confidentiality, integrity, and availability impacts. No patch or remediation information is provided in the available data.
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation. Performing a manipulation of the argument position results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used.
CVE-2026-16876 is a critical authentication bypass vulnerability in the WebGUI of NEC Corporation's UNIVERGE IX-R and IX-V series devices. This flaw allows an unauthenticated attacker to bypass authentication controls and execute arbitrary CLI commands by tampering with WebGUI messages sent to the device over the internet. The vulnerability has a high CVSS 4.0 score of 9.3, indicating it is remotely exploitable without user interaction and requires no privileges. No patch or remediation details are provided in the available data.