CVE-2026-44592 is a critical vulnerability in wavelens gradient version 1.1.0, a nix-based continuous integration system. When the configuration variable GRADIENT_DISCOVERABLE is set to true (the default), an unauthenticated attacker who can access the /proto endpoint can register as a worker by submitting a new worker UUID without any credentials. This grants the attacker a session with PeerAuth::Open privileges, allowing visibility into jobs from all organizations and the ability to push arbitrary store paths into the system's nar_storage and cached_path tables. This vulnerability is fixed in version 1.1.1. No official patch link or vendor advisory is provided in the data, and the remediation level is not specified.
DevSpace versions prior to 6.3.21 have a vulnerability where the UI server WebSocket accepts connections from all origins by default. This allows a malicious website visited by a developer to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090, exposing several endpoints without proper authentication. The issue is fixed in version 6.3.21.
CVE-2025-62619 is a medium severity vulnerability affecting AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics. It involves missing authentication on the KVM key download endpoint, which could allow an unauthenticated attacker who knows the exposed URL to retrieve sensitive keys. This exposure may lead to loss of confidentiality of those keys. There is no vendor-provided patch or official remediation guidance available at this time. No known exploits are reported in the wild. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function).
Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execute privileged operations.
ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.
CVE-2026-42303 is an authentication bypass vulnerability in ethyca's open-source privacy engineering platform, Fides, affecting versions from 2.75.0 up to but not including 2.83.2. When both subject identity verification and duplicate privacy request detection are enabled, an administrator can approve a privacy request without the subject's identity being verified. This flaw can lead to unauthorized erasure of a data subject's records across all integrations configured in the affected deployment. The vulnerability is fixed in version 2.83.2.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions.
This could allow an attacker to disrupt normal operations or perform unauthorized actions, potentially impacting system availability and integrity.
CVE-2026-43881 is a medium severity vulnerability in WWBN AVideo versions up to and including 29.0. It involves missing authentication checks in the objects/users.json.php endpoint, which exposes user account information without requiring authentication. Specifically, an isCompany parameter bypasses admin-only restrictions, and a second path allows retrieval of individual user details without permission checks. This leads to disclosure of user IDs, display names, channel URLs, photos, backgrounds, statuses, and total account counts. No official patch or remediation guidance is currently confirmed.
FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it. This vulnerability is fixed in 0.0.54.
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools. This vulnerability is fixed in 5.1.3.
CVE-2026-42312 is a vulnerability in pyLoad, a Python-based download manager, affecting versions prior to 0.5.0b3.dev100. It allows any authenticated user with non-admin SETTINGS permission to disable SSL certificate verification by setting the 'general.ssl_verify' option to off, which is not properly restricted by the application's allowlist. This results in outbound pycurl requests bypassing TLS peer and hostname verification, enabling an on-path attacker to present forged certificates. The issue is a continuation of a series of similar flaws in the same allowlist and is fixed in version 0.5.0b3.dev100.
FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution (RCE). The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces (0.0.0.0:8080). This configuration allows any user with network access to the port to bypass authentication and gain full control over the sandbox environment. This issue has been patched in version 4.14.13.
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.67.0, Scoold allows the admins configuration value to be modified through /api/config/set/admins with a forged Bearer token that is accepted as an admin API token. Once that setting is changed, the target email address is written to the application configuration file. The change does not become active immediately in the current process, because the ADMINS set is loaded once at startup. After a Scoold restart, though, the selected user is recognized as an administrator and gains access to the admin panel. This issue gives an attacker a reliable persistence path: write their own email into scoold.admins, wait for a restart or trigger one operationally, and the account comes back as admin. This issue has been patched in version 1.67.0.
PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.
CVE-2026-6736 is an authentication bypass vulnerability in GitHub Enterprise Server versions prior to 3.21. It allows an unauthenticated attacker to create a local user account despite external identity provider enforcement. The vulnerability occurs because the signup endpoint does not properly enforce authentication restrictions when external authentication is enabled. The attacker can establish a session with default base permissions on the instance. Exploitation requires network access to a vulnerable GitHub Enterprise Server instance configured with an external authentication provider. The issue was fixed in versions 3.20.2, 3.19.
The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind.
Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password hashes, customer personally identifiable information, and order data, enabling account takeover and data manipulation.
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
CVE-2026-42221 is a high-severity vulnerability in 0xJacky's nginx-ui versions 2.0.0 up to but not including 2.3.8. It allows an unauthenticated remote attacker to claim the initial administrator account during the first-run setup by accessing the public /api/install endpoint without authentication. This leads to permanent takeover of the initial instance by setting the admin email, username, and password. The vulnerability arises because the installation endpoint lacks authentication, and encryption only protects data in transit, not the authorization of the installer. This issue has been fixed in version 2.3.