Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.
Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing arbitrary files to be written to any location writable by the service account. Because the file write operation completes before authentication is validated, the vulnerability can be exploited without any credentials, session, or prior knowledge of the system.
An unauthenticated network attacker can use this primitive to place executable content in directories where it is later executed by the service, resulting in remote code execution under the Vault Service account. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 (commercial and government cloud) at the service level.
Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files from the server. No authentication, session, or credentials are required.
Because content-controlled files can be written to web-accessible directories, or used to overwrite application binaries or configuration files, exploitation can be escalated to remote code execution in the context of the service account, and can disclose deployment package contents. Altium 365 cloud deployments are not affected, as the Network Installation Service is not part of the cloud offering.
TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.
Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Redline WR3200: from 7.1.3 before 7.1.8.
CVE-2024-27892 is a high-severity vulnerability in Arista Networks EOS affecting versions 4.24.0 through 4.31.0. It involves missing authentication for a critical function where a gNMI Set request can be executed despite it being expected to be rejected. This flaw can lead to unexpected configuration changes on the affected switches.
CVE-2024-27890 is a vulnerability in Arista Networks EOS affecting versions 4.24.0 through 4.29.0 where a gNMI Set request can be executed without proper authentication when OpenConfig is configured. This allows unauthorized configuration changes on the switch. The vulnerability is rated high severity with a CVSS 4.0 score of 7.2. No official patch or remediation guidance is currently provided by the vendor.
Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016 <= R9, and DataServiceSingleton for BarTender 2019 <= R10 — configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. An unauthenticated remote attacker can exploit .NET Remoting object unmarshalling to read or write arbitrary files on the server using the .NET WebClient class, or coerce NTLMv2 authentication by supplying a UNC path to an attacker-controlled server, enabling sensitive credential disclosure, remote code execution, or lateral movement depending on service account privileges and network environment. The service runs in the context of NT AUTHORITY\\SYSTEM. This vulnerability is corrected in BarTender 12.0.1. Users of affected releases should upgrade to BarTender 12.0.1 or later.
OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM (an untrusted principal per the project's own threat model) can set it to true in any tool_use response. Combined with the default allowUnsandboxedCommands: true setting, a prompt-injected model can escape the sandbox for any arbitrary command, achieving full host-level code execution. This issue has been patched in version 0.5.1.
Improper Authentication in REST API in Collibra Agent, allows a remote unauthenticated attacker to access privileged functionality via exposed '/rest/* endpoints.
CVE-2026-24090 is a high-severity vulnerability in Qualcomm Snapdragon devices involving a cryptographic issue during the processing of partition table entries. This flaw allows unauthorized modification of the boot flow due to missing authentication for a critical function. The vulnerability has a CVSS score of 7.1, indicating significant impact on confidentiality and integrity but no impact on availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-24088 is a high-severity vulnerability in Qualcomm Snapdragon devices involving a cryptographic issue that permits unauthorized write access to load a customized bootloader. This occurs due to missing authentication for a critical function when processing a specific partition. The vulnerability can lead to full compromise of confidentiality, integrity, and availability of the affected device.
Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices communicating with the Orca server over an
unencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an
attacker to impersonate a legitimate device and inject malicious
payloads. This enables the insertion of harmful code directly
into the Orca user portal, potentially compromising user accounts,
exposing sensitive information, and allowing further unauthorized
actions within the portal.
There is an authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard application that may allow an unauthenticated remote attacker to bypass authentication controls leading to privilege escalation or information disclosure. Successful exploitation requires an attacker to send a specially crafted HTTP request. This vulnerability affects NI SystemLink Enterprise 2026-04 and prior versions.
CVE-2026-5768 is a high-severity vulnerability in the Fourth Frontier Frontier X Android application and its associated Frontier X2 device. The device permits unauthenticated Bluetooth Low Energy (BLE) read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to control device functions such as starting or stopping activities, triggering vibrations, causing denial-of-service, and fuzzing characteristic values. Additionally, the mobile application lacks proper BLE device authentication, enabling attackers to impersonate legitimate devices and inject fabricated health telemetry data. No official patch or remediation guidance is currently available.
Neotoma versions from 0.6.0 up to but not including 0.11.1 have an authentication bypass vulnerability. The application can mistakenly treat public reverse-proxied requests received over a loopback socket without a Bearer token as local requests. This causes the REST authentication middleware to resolve unauthenticated requests as the local development user, exposing the Inspector and related API without requiring credentials. This issue is fixed in version 0.11.1.