The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.
There is a misconfiguration vulnerability inside the Infotainment ECU manufactured by BOSCH. The vulnerability happens during the startup phase of a specific systemd service, and as a result, the following developer features will be activated: the disabled firewall and the launched SSH server.
First identified on Nissan Leaf ZE1 manufactured in 2020.
The One to one user Chat by WPGuppy plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/guppylite/v2/channel-authorize rest endpoint in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to intercept and view private chat messages between users.
Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (including EndeavorServer.rem and RemoteFileReceiver.rem) and permits the use of SOAP and binary formatters with TypeFilterLevel set to Full. An unauthenticated remote attacker can invoke the exposed remoting endpoints to perform arbitrary file read and write operations via the WebClient class. This allows retrieval of sensitive files such as WebRoot\\web.config, which may disclose IIS machineKey validation and decryption keys. An attacker can use these keys to generate a malicious ASP.NET ViewState payload and achieve remote code execution within the IIS application context. Additionally, supplying a UNC path can trigger outbound SMB authentication from the service account, potentially exposing NTLMv2 hashes for relay or offline cracking.
Milvus versions prior to 2.5.27 and 2.6.10 have a critical authentication bypass vulnerability. The default TCP port 9091 exposes a debug endpoint (/expr) that uses a weak, predictable authentication token, allowing arbitrary expression evaluation. Additionally, the full REST API is accessible on the metrics/management port without authentication, enabling unauthenticated access to all business operations including data and credential management. This vulnerability is fixed in versions 2.5.27 and 2.6.10.
Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Functionality Not Properly Constrained by ACLs, Privilege Escalation.
This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.
Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send AdmissionReview requests to the webhook, bypassing Kubernetes API Server authentication. This enables attackers to trigger WASM module execution in the ATC controller context without proper authorization.
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the 'sb_login_user_with_otp_fun' function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators.
METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.
METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations
Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Dinosoft ERP: from < 3.0.1 through 11022026.
NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.
CVE-2026-25885 is a critical improper authorization vulnerability in PolarLearn versions prior to 0-PRERELEASE-16. It allows unauthenticated attackers to connect to the group chat WebSocket endpoint and subscribe to or send messages in any group chat by supplying a group UUID. This flaw enables attackers to inject unauthorized messages that are stored persistently, not just displayed temporarily, leading to potential misinformation, disruption, or data integrity issues. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. The CVSS 4.0 base score is 10, reflecting its critical severity due to full network exploitability and high impact on confidentiality, integrity, and availability. European organizations using PolarLearn for educational or collaborative purposes are at risk of unauthorized data manipulation and privacy breaches. Mitigation involves upgrading to versions beyond 0-PRERELEASE-16 once available or implementing strict access controls and WebSocket authentication proxies. Countries with significant adoption of PolarLearn or similar open-source educational platforms, such as the Netherlands, Germany, France, and the UK, are most likely to be affected. Given the critical nature and ease of exploitation, immediate attention is required to prevent abuse and maintain trust in collaborative learning environments.
FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. This vulnerability is fixed in 2.2.1.
CVE-2026-25791 is a high-severity vulnerability in BishopFox's Sliver C2 framework versions prior to 1.7.0. The DNS C2 listener accepts unauthenticated TOTP bootstrap messages, allowing remote attackers to create server-side DNS sessions without validating OTPs, even when EnforceOTP is enabled. These sessions lack cleanup or expiry, enabling attackers to exhaust server memory by repeatedly creating sessions. This vulnerability impacts availability but does not affect confidentiality or integrity. No authentication or user interaction is required, and exploitation can be performed remotely over the network. The issue is fixed in Sliver version 1.7.0.
CVE-2026-2234 is a critical vulnerability in the HGiga C&Cm@il package olln-base, characterized by missing authentication for critical functions. This flaw allows unauthenticated remote attackers to read and modify any user's mail content without requiring any privileges or user interaction. The vulnerability scores 9.3 on the CVSS 4.0 scale, reflecting its high impact on confidentiality and integrity. There are no known exploits in the wild yet, but the lack of authentication makes exploitation straightforward. European organizations using this mail package are at significant risk of data breaches and mail tampering. Mitigation requires immediate deployment of patches once available or implementing network-level access controls and monitoring. Countries with higher adoption of HGiga products and critical communication infrastructures are more likely to be targeted. Due to the critical nature and ease of exploitation, urgent attention is necessary to prevent potential compromise.
