NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.
CVE-2026-82116 is a critical vulnerability in Hitachi HiRDB Server versions 9 and 10 that involves missing authentication for critical functionality. This flaw allows unauthenticated attackers to potentially execute unauthorized actions with high impact on confidentiality, integrity, and availability. The vulnerability affects multiple versions prior to 10-12-01 and has a CVSS score of 9.8. A fix is available in version 10-12-01.
CVE-2026-18450 is a critical vulnerability in SMCI X12SPI where the Baseboard Management Controller (BMC) fails to properly enforce integrity and encryption requirements for IPMI commands. This flaw allows an attacker to craft malicious packets that can execute arbitrary commands on an active session without authentication.
CVE-2026-102649 is a critical vulnerability in padok-team's burrito Kubernetes operator versions prior to 0.13.0. The vulnerability arises from missing authentication on the POST /api/webhook endpoint when the webhookSecret is omitted or empty in TerraformRepository credentials. This allows unauthenticated attackers who can reach the endpoint and know a tracked repository URL to forge GitHub or GitLab webhook events. Exploitation can lead to unauthorized creation or deletion of TerraformPullRequest custom resources with attacker-controlled branch, base, and ID fields. This can cause unauthorized terraform plan operations and disclosure of plan details in pull request comments. The issue is fixed in version 0.13.0.
CVE-2026-77061 is a vulnerability in boneIO versions 1.2.0 up to but not including 1.6.0 where several API endpoints lack authentication. This allows an unauthenticated attacker on the local network to access sensitive information such as system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. The issue was fixed in version 1.6.0 by enforcing authentication on all API routes, disabling interactive API documentation, and withholding the serial number from anonymous users.
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits.
This issue was fixed in version 1.6.0: a device without an administrator account refuses API requests until the owner creates one in the first-run wizard, and every API route is restricted to an authenticated role.
Versions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place; affected devices should be re-flashed with the 1.6.0 system image.
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.
This issue was fixed in version 1.6.0.
CVE-2026-55463 is a vulnerability in intranda's goobi-viewer-core web application versions from 4.11.0 up to but not including 26.05. Several Jakarta WebSocket endpoints do not verify that the HttpSession belongs to a logged-in user and fail to validate the Origin header. This allows unauthenticated attackers to connect and disrupt the crowdsourcing page-lock mechanism by broadcasting forged lock messages. The issue is fixed in version 26.05.
CVE-2026-46651 is a critical vulnerability in intranda goobi-viewer-core versions 24.03 up to but not including 26.05. The DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) accepts download requests from unauthenticated users, allowing unauthorized access to critical functionality. This flaw has been fixed in version 26.05.
NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox tools - no token or credential needed. This issue has been patched in version 1.2.1.
CVE-2026-114357 is a vulnerability in the DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9. It involves missing authentication in the Android Debug Bridge daemon (adbd), allowing attackers to obtain an unauthenticated shell with user ID 2000. The device ships with ADB host key authorization disabled and USB ADB enabled by default. If ADB over TCP is enabled, the unauthenticated shell can be accessed remotely over the network. This vulnerability has a high severity rating with a CVSS 4.0 base score of 7.
PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.
PraisonAI versions from 4.2.1 up to but not including 4.6.59 have an unauthenticated AgentOS FastAPI deployment surface. This allows unauthorized actors to invoke agent chat functionality without authentication, potentially exposing sensitive information and enabling unauthorized actions. The vulnerability has been fixed in version 4.6.59.
PraisonAI versions 4.6.56 through 4.6.58 contain an improper authentication vulnerability in the LinearBot component. The bot starts a public webhook listener without requiring the LINEAR_WEBHOOK_SECRET, allowing unauthenticated network callers to submit forged Linear-Event: AgentSession requests. This leads to unauthorized processing of these requests and potential misuse of the bot's capabilities. The issue is fixed in version 4.6.59.
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.
CVE-2025-30053 is a vulnerability in the CGM CLININET application where the cgm-updater process listens on an open network port without requiring authentication. This missing authentication allows unauthorized access to critical functionality. The issue affects versions up to 2026.MS3, but versions 2026.MS3 with the updater-upkg component at version 5.3.0 or higher are not vulnerable.
CGM CLININET contains a vulnerability identified as CVE-2025-30043, where the /DocManagment endpoint lacks authentication. This allows unauthenticated attackers on adjacent networks to access and download patient documents. The issue is fixed in version 2026.MS3.
CVE-2026-107858 is a vulnerability in Google Agent Development Kit (ADK) for Java versions before 1.13.0. It involves missing origin validation in WebSockets and a permissive cross-domain policy, allowing remote attackers to control a locally running agent and access its data via a malicious web page visited by a developer. The vulnerability is fixed in version 1.13.0, which enforces same-origin policies and rejects DNS-rebinding requests over loopback.