Vitals ESP developed by Galaxy Software Services has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to execute certain functions to obtain sensitive information.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN/status.json.php` and `plugin/CDN/disable.json.php` use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured (the default state), the key validation check is completely bypassed, allowing any unauthenticated attacker to modify the full CDN configuration — including CDN URLs, storage credentials, and the authentication key itself — via mass-assignment through the `par` request parameter. Commit adeff0a31ba04a56f411eef256139fd7ed7d4310 contains a patch.
CVE-2025-15517 is a high-severity vulnerability affecting TP-Link Archer NX600 v3.0 and related models, caused by missing authentication checks on certain HTTP CGI endpoints. This flaw allows unauthenticated attackers to perform privileged actions such as firmware uploads and configuration changes without requiring any credentials or user interaction. The vulnerability impacts multiple models including NX200, NX210, NX500, and NX600, exposing critical router management functions to remote exploitation. The CVSS 4.0 score of 8.6 reflects the high impact on confidentiality and integrity with no authentication or user interaction needed, though the attack vector is adjacent network. No known exploits are currently reported in the wild. Organizations using these TP-Link devices risk unauthorized control over network infrastructure, potentially leading to persistent compromise, network disruption, or interception of sensitive data. Mitigation requires immediate firmware updates from the vendor once available, network segmentation to limit access to router management interfaces, and monitoring for suspicious HTTP requests targeting vulnerable endpoints.
Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.
A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. This affects an unknown function of the component BLE Interface. Such manipulation leads to missing authentication. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging
infrastructure, and corruption of charging network data reported to the backend.
SiYuan is a personal knowledge management system. Prior to version 3.6.2, the SiYuan kernel WebSocket server accepts unauthenticated connections when a specific "auth keepalive" query parameter is present. After connection, incoming messages are parsed using unchecked type assertions on attacker-controlled JSON. A remote attacker can send malformed messages that trigger a runtime panic, potentially crashing the kernel process and causing denial of service. Version 3.6.2 fixes the issue.
CVE-2026-22898 is a critical vulnerability in QNAP Systems Inc. 's QVR Pro product, specifically affecting version 2.7.x. It is caused by missing authentication for a critical function, allowing remote attackers to gain unauthorized access to the system. This vulnerability has been fixed in QVR Pro version 2.7.4.14 and later. The CVSS 4.
FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial of service to shared file access. The POST /api/file/deleteShareLink.php endpoint calls FileController::deleteShareLink() which performs no authentication, authorization, or CSRF validation before deleting a share link. Any anonymous HTTP client can destroy share links. This issue is fixed in version 3.8.0.
CVE-2026-33038 is a high-severity vulnerability in WWBN AVideo versions 25.0 and below that allows unauthenticated attackers to take over the application during initial setup via the install/checkConfiguration.php endpoint. This endpoint performs critical functions such as database setup, admin account creation, and configuration file writing without authentication, relying solely on the presence of a configuration file to block reinstallation. Attackers can exploit uninitialized deployments to gain full administrative control by completing the installation with attacker-controlled credentials and database. The vulnerability has been fixed in version 26.0. Exploitation requires network access to the endpoint but no user interaction or privileges. Organizations using affected versions on new or reset deployments are at significant risk of complete compromise. Mitigation involves upgrading to version 26.
CVE-2026-33017 is a critical unauthenticated remote code execution vulnerability in langflow versions prior to 1.9.0. The vulnerability exists in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which allows building public flows without authentication. When the optional data parameter is supplied, attacker-controlled flow data containing arbitrary Python code is executed via exec() without sandboxing. This flaw enables attackers to execute arbitrary code remotely without any privileges. The issue was fixed in langflow version 1.9.0.
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
The "Privileged Helper" component of the Arturia Software Center (MacOS) does not perform sufficient client code signature validation when a client connects. This leads to an attacker being able to connect to the helper and execute privileged actions leading to local privilege escalation.
CVE-2026-22727 is a high-severity vulnerability in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below. It involves unprotected internal endpoints that allow any user who has bypassed the firewall to replace droplets and applications. This can lead to unauthorized access to secure application information. The vulnerability is categorized under CWE-306, indicating missing or insufficient authentication. Exploitation does not require user interaction or privileges but does require network access that bypasses firewall protections. No known exploits are currently reported in the wild.
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 allows a remote unauthenticated attacker to view and delete the partners of a community and to delete the communities.
The Angeet ES3 KVM allows a remote, unauthenticated attacker to write arbitrary files, including configuration files or system binaries. Modified configuration files or system binaries could allow an attacker to take complete control of a vulnerable system.
Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration endpoint without proper security checks, allowing an unauthenticated attacker with network access to change the saved configured Wi-Fi network to one of the attacker's choosing, or craft a request to exhaust the system memory and terminate the KVM process.