An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.
Kiloview E3 Firmware versions prior to 1.30 have a vulnerability in the ONVIF device service that allows unauthenticated remote attackers to obtain detailed device identifiers and user account information. This missing authentication on critical functionality enables attackers to fingerprint devices and plan credential attacks. The issue is fixed in version 1.30.
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-13599 is a vulnerability in ABB Ability Edgenius up to version 3.2.3.0 where critical functionality lacks proper authentication. This flaw allows unauthorized access to sensitive operations within the product. The vulnerability has a high severity rating with a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No public exploits or known active exploitation have been reported. The product is not a cloud service, and no patch or remediation details are currently provided.
CVE-2026-103090 affects Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8. It involves missing authentication and insufficient credential protection in the control plane enrollment status handler, allowing unauthenticated attackers to retrieve signed identity tokens and replay them to access or modify mesh policies and router information. The issue is fixed in version 0.1.0-alpha.9, which adds cryptographic proof requirements, rate limiting, and validation of router lease addresses.
CVE-2026-82987 is a vulnerability in the ViewSonic vCast media streaming service used in ViewBoard devices. It involves missing authentication on a screen capture endpoint, allowing remote unauthenticated attackers to retrieve current screen content as JPEG images via GET requests to /snapshot or /screen endpoints. This flaw affects versions up to and including 3.2.715 and has a high severity rating with a CVSS score of 7.5.
Apache Traffic Server's experimental tsmemcache plugin has a critical vulnerability (CVE-2026-111811) that allows unauthenticated network users to read, write, and delete the shared proxy cache. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and exactly 10.2.0. The vulnerability is due to missing authentication for critical functions in the plugin. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
Apache Pulsar Manager contains multiple critical authentication flaws that allow unauthenticated users to create administrator accounts, proxy requests with administrative credentials, and gain full control over the management interface. These issues affect versions from 0.1.0 through 0.4.0. The project is no longer maintained, and no fixes will be released. Users are advised to stop using Pulsar Manager, remove deployments, and restrict network access until removal.
A path traversal vulnerability (CWE-22) in Storybook development server versions from 8.0.0 up to but not including 8.6.19, 9.0.0 up to 9.1.21, 10.0.0 up to 10.6.2, and 11.0.0-alpha.0 up to 11.0.0-alpha.6 allows an attacker on the local network to obtain the WebSocket authentication token. This token can be used to invoke file-writing or testing functionality, potentially leading to code execution if the Vitest addon is installed with an old Vitest version. The issue is fixed in versions 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
CVE-2026-114123 is a vulnerability in dynamics365ninja d365fo-mcp-server versions prior to 1.11.0 where missing authentication allows unauthenticated access to critical read-only API endpoints. The default Azure deployment sets the API key to an empty string, causing the server to accept requests without authentication. This exposes proprietary X++ source code snippets and metadata, including business logic and security role information. The issue is fixed in version 1.11.0.
CVE-2024-5563 is a vulnerability in WSO2 Identity Server versions 7.0.0 up to but not including 7.0.0.37. It involves missing application of reCaptcha in certain authentication flows despite the reCaptcha option being enabled. This flaw allows attackers to bypass the intended reCaptcha protection, potentially enabling brute force attacks that could lead to unauthorized access to user accounts and sensitive information.
CVE-2026-78334 is a critical vulnerability in Apache bRPC versions prior to 1.18.0 that allows remote attackers to bypass server authentication in the streaming RPC path. This occurs because streaming RPC frames bypass the authentication hook, enabling unauthenticated peers to inject or deliver streaming frames. The vulnerability affects servers configured with authentication serving streaming RPC from untrusted networks or where foreign connections can impersonate streams by ID. The issue is fixed in version 1.18.0, which enforces authentication on streaming frames and binds streams to the socket that created them.
Apache IoTDB versions from 2.0.0 up to but not including 2.0.11 contain a critical vulnerability due to missing authentication for critical functionality. This flaw allows unauthenticated attackers to potentially access or manipulate sensitive functions. The issue is resolved in version 2.0.11.
CVE-2026-97406 is a critical vulnerability in the Xerj Console API version 1.0.0-rc.11 where bearer tokens can bypass the intended passkey-only authentication. This flaw allows unauthorized users to invoke the API-token creation endpoint directly, enabling them to mint persistent successor credentials without proper authorization.
ApostropheCMS versions prior to 3.7.1 and 4.34.0 have a missing authentication vulnerability in the import-export module. The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export lacks authentication and authorization checks, allowing any client, including unauthenticated users with a standard CSRF cookie, to invoke a critical function. This issue is fixed in versions 3.7.1 and 4.34.0.
Vitest, a Vite-native testing framework for JavaScript and TypeScript, contains a code injection vulnerability in versions from 2.1.0-beta.7 up to but not including 4.1.12 and from 5.0.0 up to but not including 5.0.3. An unauthenticated non-browser WebSocket client can exploit this by registering a manual mock with an attacker-controlled URL that is inserted unescaped into generated module source. This leads to execution of attacker-controlled JavaScript on the development server origin when the developer's browser loads the module. The issue is fixed in versions 4.1.12 and 5.0.3.
CVE-2026-75753 is a vulnerability in certain ASUS routers where missing authentication for a critical function allows an unauthorized nearby user to send HTTP requests to the device. This can cause the router to disclose device identification information and switch into a specific mode that may impair its ability to perform self-recovery under abnormal conditions.
Dell Application Store versions prior to 26.05.0.7 contain a vulnerability due to missing authentication for a critical function. This flaw allows an unauthenticated attacker with adjacent network access to potentially execute arbitrary code on the affected system. The vulnerability has a high severity rating with a CVSS score of 8.8. A fix is available in version 26.05.0.7.