Chartbrew version 4.9.0 contains a vulnerability where the POST /user/invited endpoint does not require authentication or validate invite tokens. This allows unauthenticated attackers to create fully active accounts and obtain valid JWTs, bypassing signup restrictions. The issue is fixed in version 5.0.0.
CVE-2026-0204 is a high-severity vulnerability in SonicWall SonicOS affecting multiple versions up to 8.1.0-8017. It involves a weakness in the access control mechanism that may allow certain management interface functions to be accessed under specific conditions. The vulnerability has a CVSS score of 8.0, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to the control panel. This critical vulnerability has a CVSS 4.0 score of 9.3 and is known to be actively exploited in the wild, including use in ransomware campaigns.
The Carlson VASCO-B GNSS Receiver has a critical vulnerability (CVE-2026-3893) due to the absence of any authentication mechanism. This flaw allows an attacker with network access to directly access and modify the device's configuration and operational functions without requiring credentials. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). It has a high CVSS score of 9.4, reflecting its critical impact on integrity and availability. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild at this time.
An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endpoint on TCP port 7373 that is accessible within the network scope of the deployment environment without authentication.
An unauthenticated attacker with network access can exploit this vulnerability by sending crafted requests to the exposed endpoint to enumerate cluster metadata, including virtual machine information and cluster configuration details. While the API primarily supports read-only operations, it also allows certain cluster maintenance workflows to be invoked.
Although this vulnerability does not allow persistent modification of system configurations or access to credentials or sensitive user data, successful exploitation may result in disruption of active workloads, leading to loss of service availability within the affected environment.
An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.
CVE-2024-54013 is a high-severity vulnerability in the Hanwha Vision QND-8080R device involving missing authentication for a critical function in its web server component. Discovered by penetration testers at Amazon, the flaw could allow unintended access to protected functions under certain conditions. The manufacturer has released patch firmware addressing this issue. The vulnerability has a CVSS 4.0 score of 8.7, indicating a high impact with network attack vector and no required privileges or user interaction. No known exploits are reported in the wild at this time.
CVE-2026-7042 is a medium severity vulnerability in 666ghj MiroFish versions up to 0.1.2. It involves missing authentication in the create_app function of the REST API endpoint, allowing remote attackers to manipulate the application without proper authentication. Although an exploit has been published, the vendor has not yet responded or issued a fix. No official patch or remediation guidance is currently available.
CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.
CVE-2026-6272 is a high-severity vulnerability in Eclipse Foundation's Eclipse KUKSA - Databroker version 0.5.0. It involves missing authentication for a critical function, allowing a client with only read JWT scope to register as a signal provider via the OpenProviderStream API. This enables the attacker to send forged data responses to other clients requesting signal values, potentially compromising data integrity.
CVE-2026-25775 is a critical vulnerability in the SenseLive X3050 device's remote management service. It allows unauthenticated and unauthorized firmware retrieval and update operations. The service does not verify user privileges, the integrity of uploaded firmware images, or the authenticity of the firmware, exposing the device to potential malicious firmware manipulation. This vulnerability affects version V1.523 of the product. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.
CVE-2026-35064 is a high-severity vulnerability in the SenseLive X3050 management ecosystem that allows unauthenticated attackers on the same network segment to discover deployed devices. The vulnerability arises because the device discovery function is exposed without requiring authentication, enabling attackers to identify device presence, identifiers, and management interfaces. This lack of authentication for a critical function can facilitate rapid enumeration of targeted devices by unauthorized parties.
CVE-2026-40620 is a critical vulnerability in the SenseLive X3050 device's embedded management service that allows an attacker to gain full administrative control without any authentication or authorization. The vulnerable service accepts management connections from any reachable host, enabling unrestricted modification of critical configuration parameters, operational modes, and device state. This lack of authentication exposes the device to complete compromise by unauthorized parties.
CVE-2026-42095 is a medium severity vulnerability in KDE Arianna's bookserver component before version 26.04.1. It allows attackers to read files over a socket connection by guessing a URL due to missing authentication on a critical function. The vulnerability does not require user interaction or privileges and has a low complexity for exploitation. There is no confirmed patch or official remediation available at this time.
CVE-2026-27843 is a critical vulnerability in the SenseLive X3050 device's web management interface that allows modification of critical configuration parameters without proper authentication or server-side validation. Exploitation can cause a persistent lockout state by applying unsupported or disruptive values to recovery and network settings. The device lacks a physical reset button, so recovery requires specialized console access to perform a factory reset, resulting in a total denial-of-service for the gateway and connected RS-485 systems.
CVE-2026-6376 is a high-severity vulnerability in SpiceJet's Online Booking System that allows unauthenticated access to full passenger booking details using only a PNR and last name. This lack of authentication on a critical function exposes extensive personal, travel, and booking metadata to anyone who can obtain or guess these inputs. The vulnerability stems from missing access control on a sensitive data retrieval feature. There is no official patch or remediation level currently documented. No known exploits are reported in the wild at this time.
Flowise versions prior to 3.1.0 have an authentication bypass vulnerability that allows unauthenticated attackers to obtain OAuth 2.0 access tokens linked to public chatflows. By accessing a public chatflow configuration endpoint, attackers can retrieve internal workflow data including OAuth credential identifiers, enabling them to refresh and acquire valid OAuth tokens without authentication. This vulnerability is fixed in version 3.1.0.
Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service that is accessible without authentication and uses a default, publicly known endpoint identifier. An unauthenticated remote attacker can exploit .NET Remoting object unmarshalling techniques to instantiate a remote System.Net.WebClient object and read arbitrary files from the server filesystem, write attacker-controlled files to the server, or coerce NTLMv2 authentication to an attacker-controlled host, enabling sensitive credential disclosure, denial of service, remote code execution, or lateral movement depending on service account privileges and network environment.
CVE-2026-40884 is a critical vulnerability in goshs, a SimpleHTTPServer written in Go, affecting versions prior to 2.0.0-beta.6. The issue arises when the server is started with the -b ':pass' option together with -sftp, causing goshs to accept the configuration but fail to install any SFTP password handler. This results in an authentication bypass allowing unauthenticated network attackers to access files via the SFTP service without a password. The vulnerability is fixed in version 2.0.0-beta.6.
CrowdStrike has released security updates to address a critical unauthenticated path traversal vulnerability (CVE-2026-40050) in LogScale. This vulnerability only requires mitigation by customers that host specific versions of LogScale and does not affect Next-Gen SIEM customers. The vulnerability exists in a specific cluster API endpoint that, if exposed, allows a remote attacker to read arbitrary files from the server filesystem without authentication.
Next-Gen SIEM customers are not affected and do not need to take any action. CrowdStrike mitigated the vulnerability for LogScale SaaS customers by deploying network-layer blocks to all clusters on April 7, 2026. We have proactively reviewed all log data and there is no evidence of exploitation.
LogScale Self-hosted customers should upgrade to a patched version immediately to remediate the vulnerability.
CrowdStrike identified this vulnerability during continuous and ongoing product testing.