FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.
CVE-2026-1633 is a critical vulnerability in the Synectix LAN 232 TRIO 3-Port serial to Ethernet adapter, where its web management interface lacks any authentication. This allows unauthenticated attackers to access and modify critical device settings or perform a factory reset remotely. The vulnerability affects all versions of the product and has a CVSS score of 10.0, indicating maximum severity with full impact on confidentiality, integrity, and availability without requiring any privileges or user interaction. Although no known exploits are currently reported in the wild, the risk is significant due to the device's role in network infrastructure. European organizations using this device in industrial or network environments face potential operational disruption and security breaches. Mitigation requires isolating the device from untrusted networks, implementing network-level access controls, and monitoring for unauthorized access. Countries with higher industrial automation adoption and Synectix product usage, such as Germany, France, and the UK, are most at risk. Immediate attention is necessary to prevent exploitation and ensure network security.
CVE-2026-1632 is a critical vulnerability in RISS SRL's MOMA Seismic Station (version 2.4.2520 and earlier) where the web management interface lacks authentication. This allows unauthenticated attackers to access the device's configuration, extract sensitive data, or remotely reset the device. The vulnerability has a CVSS score of 9.1, indicating high severity with network attack vector, no privileges or user interaction required, and impacts confidentiality and integrity. Although no known exploits are currently reported in the wild, the exposure of critical infrastructure devices like seismic stations poses significant risks. European organizations operating these devices could face operational disruptions and data compromise. Mitigations include network segmentation, restricting access to the management interface, deploying compensating controls such as VPNs or firewalls, and monitoring for unauthorized access. Countries with active seismic monitoring infrastructure and critical geological research facilities, such as Italy, Germany, France, and Spain, are most likely to be affected.
The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store. Unauthorized access is evident from http requests. If kept, searching access logs and/or Odoos log for requests to /web/database can give indicators, if this has been actively exploited. The database manager is a featured intended for development and not meant to be publicly reachable. On other setups, a master password acts as 2nd line of defence. However, due to the nature of NixOS, Odoo is not able to modify its own configuration file and thus unable to persist the auto-generated password. This also applies when manually setting a master password in the web-UI. This means, the password is lost when restarting Odoo. When no password is set, the user is prompted to set one directly via the database manager. This requires no authentication or action by any authorized user or the system administrator. Thus, the database is effectively world readable by anyone able to reach Odoo. This vulnerability is fixed in 25.11 and 26.05.
CVE-2026-24728 is a critical vulnerability in Internet Information Co. , Ltd's DreamMaker product, affecting versions prior to 2025/10/22. The flaw is due to missing authentication on the /servlet/baServer3 endpoint, allowing remote attackers to access administrative functions without any credentials. This vulnerability has a CVSS 4.0 score of 9.3, indicating high impact on confidentiality, integrity, and availability with no user interaction or privileges required. Exploitation could lead to full compromise of affected systems. No public exploits are currently known. European organizations using DreamMaker are at significant risk, especially those in sectors relying on this software for critical operations. Mitigation requires immediate patching once available, network segmentation, and monitoring of access to the vulnerable endpoint.
A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vulnerability can grant the attacker full administrative control over the product.
Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to the access point.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
The exos 9300 application can be used to configure Access Managers (e.g.92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configuration is sent to the selected Access Manager via SOAP. The SOAP request is sent without any prior authentication or authorization by default. Though authentication and authorization can be configured using IPsec for 92xx-K5 devices and mTLS for 92xx-K7 devices, it is not enabled by default and must therefore be activated with additional steps.
This insecure default allows an attacker with network level access to completely control the whole environment. An attacker is for example easily able to conduct the following tasks without prior authentication:
- Re-configure Access Managers (e.g.remove alarming system requirements)
- Freely re-configure the inputs and outputs
- Open all connected doors permanently
- Open all doors for a defined time interval
- Change the admin password
- and many more
Network level access can be gained due to an insufficient network segmentation as well as missing LAN firewalls. Devices with an insecure configuration have been identified to be directly exposed to the internet.
On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g.the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards.
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
CVE-2026-1364 is a critical vulnerability in JNC's IAQS product, characterized by missing authentication for critical system functions. This flaw allows unauthenticated remote attackers to directly access and operate administrative functionalities without any credentials. The vulnerability has a high CVSS 4.0 score of 9.3, reflecting its ease of exploitation and severe impact on confidentiality, integrity, and availability. No user interaction or privileges are required to exploit this issue, making it highly dangerous. Although no known exploits are currently reported in the wild, the lack of authentication on critical functions poses a significant risk of unauthorized control and potential system compromise. European organizations using IAQS should urgently assess exposure and implement compensating controls. Countries with higher adoption of JNC IAQS or critical infrastructure relying on it are at greater risk. Immediate mitigation includes network segmentation, strict access controls, and monitoring for anomalous administrative activity until a patch is available.
CVE-2026-0778 is a high-severity vulnerability in the Enel X JuiceBox 40 electric vehicle charging stations, specifically in the Telnet service running on TCP port 2000. The flaw is due to missing authentication, allowing network-adjacent attackers to execute arbitrary code remotely without any credentials or user interaction. Exploitation results in full compromise of confidentiality, integrity, and availability of the affected device. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to installations running version 4.2.7. European organizations using these charging stations could face operational disruptions and potential lateral movement into broader networks. Mitigations include network segmentation, disabling Telnet if possible, restricting access to port 2000, and monitoring for unusual activity. Countries with high EV adoption and deployments of Enel X JuiceBox 40, such as Germany, France, Italy, and the Netherlands, are most likely to be impacted. Given the ease of exploitation and critical impact, this vulnerability demands urgent attention from defenders.
Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1.
MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functions and obtain meeting-related information.
SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a missing authentication vulnerability in the /api/v1/datasource/uploadExcel endpoint, allowing a remote unauthenticated attacker to upload arbitrary Excel/CSV files and inject data directly into the PostgreSQL database. The endpoint is explicitly added to the authentication whitelist, causing the TokenMiddleware to bypass all token validation. Uploaded files are parsed by pandas and inserted into the database via to_sql() with if_exists='replace' mode. The vulnerability has been fixed in v1.5.0. No known workarounds are available.
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to remote environment agents, allowing access to remote environment resources without authentication. The environment proxy middleware handled `/api/environments/{id}/...` requests for remote environments before authentication was enforced. When the environment ID was not local, the middleware proxied the request and attached the manager-held agent token, even if the caller was unauthenticated. This enabled unauthenticated access to remote environment operations (e.g., listing containers, streaming logs, or other agent endpoints). An unauthenticated attacker could access and manipulate remote environment resources via the proxy, potentially leading to data exposure, unauthorized changes, or service disruption. Version 1.13.2 patches the vulnerability.
CVE-2026-23744 is a critical remote code execution vulnerability in MCPJam inspector versions 1.4.2 and earlier. The flaw arises because the application listens on all network interfaces (0.0.0.0) by default and lacks authentication for a critical function that installs an MCP server. An attacker can exploit this by sending a crafted HTTP request remotely, triggering server installation and arbitrary code execution without any user interaction or privileges. The vulnerability has a CVSS score of 9.8, indicating a severe risk to confidentiality, integrity, and availability.
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clearOrderLogs() function in all versions up to, and including, 5.1.5. This makes it possible for unauthenticated attackers to delete the Rede Order Logs metadata from all WooCommerce orders.
