TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig.
TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the attacker to access functionality intended for authenticated users and may expose or modify device configuration and data. Logging out from the bypassed state can additionally cause the web server to crash.
CVE-2026-72688 is a high-severity vulnerability in OpenSignLabs opensignserver up to version 2.37.0. It involves missing authentication in the fileupload Parse cloud function, allowing unauthenticated remote attackers to read arbitrary stored documents. The vulnerability arises because the function issues MASTER_KEY-signed file access tokens for any caller-supplied URL without verifying session or user authentication, bypassing the intended access control for stored contract files.
CVE-2026-72593 is a critical missing authentication vulnerability in dulldusk/phpfm versions prior to 1.8.1. This flaw allows unauthenticated remote attackers to fully access the file manager functionality, including reading, writing, deleting, and uploading files anywhere on the server filesystem.
CVE-2026-72586 is a high-severity vulnerability in frangoteam FUXA up to version 1.3.3 where the DAQ_QUERY Socket.IO event handler lacks authentication checks. This allows unauthenticated remote attackers to query all historical sensor data. Other sensitive Socket.IO events enforce token-based authorization when secureEnabled=true, but DAQ_QUERY does not, leading to unauthorized data access.
NASA fprime-gds versions prior to 3.4.4 contain multiple vulnerabilities due to missing authentication on all Flask application endpoints. This allows unauthenticated remote attackers to execute arbitrary code on the ground station host and send arbitrary commands to connected spacecraft. The flaw is caused by the lack of authentication enforcement in the src/fprime_gds/flask/app.py component.
CVE-2026-55814 is a high-severity vulnerability in Apache Ranger versions up to and including 2.8.0. It involves missing authentication in the Download APIs, allowing unauthenticated access to critical functions. The issue is fixed in version 2.9.0, and users are advised to upgrade to this version to mitigate the risk.
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.
Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency.
Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can reach the Dinky HTTP port (8888 by default) receives the full live system configuration (54 entries on a stock v1.2.5 install) with one parameterless GET. Only one credential field (sys.maven.settings.repositoryPassword) has a desensitization handler wired; the other credential-bearing fields (sys.env.settings.dinkyToken, sys.ldap.settings.userPassword, sys.resource.settings.oss.accessKey and secretKey, and sys.dolphinscheduler.settings.token) return in cleartext. A bare install leaks the shipped defaults, including the hardcoded dinkyToken efda1551-7958-4e0f-80a8-dfd107df3e38 and minioadmin/minioadmin OSS keys; once an operator configures LDAP, object storage, or DolphinScheduler through the Settings Center, those live third-party credentials leak from the same endpoint. Because dinkyToken is the sole gate on the sibling POST /download/uploadFromRsByLocal arbitrary file write, this disclosure defeats token rotation as a mitigation for that vulnerability. Affects Dinky v1.2.5 (the current release, 2025-11-05) and the development branch (dev HEAD 63b5a5a), where the affected code is byte-identical.
Ground Station prior to version 0.6.0 has a critical vulnerability in its Socket.IO server's database_backup event handler that allows unauthenticated network peers to destroy or replace the entire SQLite database. Due to disabled authentication enforcement and a wildcard CORS policy, attackers can connect without credentials and execute arbitrary SQL commands to wipe or manipulate satellite data and configurations.
Ground Station versions prior to 0.6.0 have a high-severity unauthenticated denial-of-service vulnerability in the Socket.IO server. This flaw allows any unauthenticated network peer to send a restart_service command via the service_control event, forcibly terminating the ground-station process. The vulnerability arises from disabled authentication enforcement and a wildcard CORS policy on port 7000, enabling attackers to disrupt satellite-tracking sessions and related services. Repeated exploitation in Docker deployments can cause persistent denial-of-service conditions.
A critical code injection vulnerability (CWE-94) exists in Nuxt DevTools versions prior to 3.3.1. The devtools expose an unauthenticated bidirectional RPC channel over the Vite HMR WebSocket, allowing any client with network access to the HMR endpoint to invoke certain RPC methods without authentication. Specifically, the updateOptions() and openInEditor() methods lack proper authentication checks, enabling an attacker to set arbitrary commands and execute them on the developer's machine. This vulnerability is fixed in version 3.3.1.
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth .
CVE-2026-48911 is a high-severity vulnerability in Apache Answer up to version 2.0.1. It involves a missing authorization check in the external-login email binding flow, allowing unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link. The issue is fixed in version 2.0.2.
The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. ":8089/tcp") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary.
Eclipse Theia versions up to and including 1.73.1 contain a directory traversal vulnerability in the @theia/filesystem backend HTTP file-download endpoints. These endpoints convert client-supplied URIs directly to filesystem paths without restricting access to the workspace or allowed roots. In browser deployments, token enforcement is ineffective on HTTP requests, allowing unauthenticated clients to read any file accessible by the backend process, including sensitive files outside the workspace. Electron mode is not affected by this vulnerability via this path.
Eclipse Theia versions up to and including 1.73.1 have a vulnerability in the @theia/filesystem backend where an unauthenticated attacker can perform arbitrary file writes outside the workspace via a specially crafted POST /file-upload request. This occurs because the handler accepts an absolute path from user input without workspace confinement or authentication. Browser deployments are affected due to insufficient token enforcement on HTTP requests, enabling cross-origin web pages to exploit this without credentials. Electron mode is not affected by this issue. The vulnerability has a high severity CVSS score of 8.8 and can lead to remote code execution by overwriting critical files such as ~/.bashrc.