Statistics Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly exploit a specific functionality to query database contents.
Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service (DCG.SmartCardControllerService.exe). The service registers a TCP remoting channel with unsafe formatter/settings that permit untrusted remoting object invocation. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, and may achieve arbitrary file write and remote code execution via known .NET Remoting exploitation techniques. This can lead to disclosure of sensitive installation and service-account data and compromise of the affected host.
A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Control Center settings if the device is locked when the "Allow Control Center access when locked" option is disabled.
The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable admin API to create a new user with admin privileges. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform by logging in to the newly-created admin user.
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and availability.
CVE-2026-22812 is a high-severity vulnerability in anomalyco's OpenCode AI coding agent versions prior to 1.0.216. The flaw involves the automatic startup of an unauthenticated HTTP server that permits any local process or any website (due to permissive CORS settings) to execute arbitrary shell commands with the user's privileges. This missing authentication for a critical function allows attackers to compromise confidentiality, integrity, and availability of affected systems. The vulnerability is fixed in version 1.0.216. Although no known exploits are currently reported in the wild, the ease of exploitation and potential impact make it a significant threat. European organizations using vulnerable OpenCode versions are at risk, especially those with development environments or CI/CD pipelines integrating this tool.
CVE-2026-22788 is a high-severity vulnerability in SMEWebify's WebErpMesv2 versions prior to 1.19, where multiple sensitive API endpoints lack authentication. This allows unauthenticated remote attackers to access critical business data such as companies, quotes, orders, tasks, and whiteboards. Attackers can also perform limited write operations, including creating company records and fully manipulating collaboration whiteboards. The vulnerability does not require user interaction or authentication and has a CVSS score of 8.2, indicating a significant risk to confidentiality and partial impact on integrity. The issue is resolved in version 1.19. European organizations using affected versions face risks of data exposure and unauthorized data manipulation, especially in manufacturing and resource management sectors. Mitigation involves immediate upgrading to version 1.
The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authentication to this service relies on a hardcoded Time-based One-Time Password (TOTP) secret and an embedded static token. An attacker who extracts these credentials from the appliance or a compromised device can generate valid authentication tokens and execute arbitrary OS commands with root privileges, resulting in complete system compromise.
Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera's feed, potentially compromising user privacy and security.
The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.
A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be fully enforced.
Because the WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT flag was not included, the behavior effectively matched CERT_OPTIONAL: a peer certificate was verified if presented, but connections were incorrectly authenticated when no client certificate was provided.
This results in improper authentication, allowing attackers to bypass mutual TLS (mTLS) client authentication by omitting a client certificate during the TLS handshake.
The issue affects versions up to and including 5.8.2.
CVE-2025-31963 is a vulnerability in HCL BigFix IVR version 4.2 involving missing authentication and lack of CSRF protection in its local setup interface. This flaw allows a local attacker with high privileges to perform unauthorized configuration changes by sending unauthenticated administrative requests. The vulnerability requires local access and user interaction, with a low CVSS score of 2.9, indicating limited impact. Although the confidentiality and integrity of configuration data can be affected, availability remains intact. No known exploits are reported in the wild, and no patches have been published yet. European organizations using BigFix IVR 4.2 should be cautious, especially those with critical infrastructure relying on this product. Mitigation involves restricting local access, monitoring configuration changes, and applying vendor updates once available.
OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.
Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DNS settings without valid credentials, enabling DNS hijacking (“DNSChanger”) attacks that redirect user traffic to attacker-controlled infrastructure. In 2019, D-Link reported that this behavior was leveraged by the "GhostDNS" malware ecosystem targeting consumer and carrier routers. All impacted products were subsequently designated end-of-life/end-of-service, and no longer receive security updates. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC).
CVE-2025-14346 is a critical vulnerability affecting WHILL Model C2 Electric Wheelchairs and Model F Power Chairs, where Bluetooth connections lack authentication. An attacker within Bluetooth range can pair with the device without credentials or user interaction, allowing full control over movement commands, speed settings, and configuration profiles. This vulnerability poses severe risks to user safety and privacy. The CVSS score is 9.8, reflecting high impact on confidentiality, integrity, and availability. No patches are currently available, and no exploits have been observed in the wild yet. European organizations involved in healthcare, rehabilitation centers, and mobility services using these devices are at risk. Mitigation requires disabling Bluetooth when not in use, physical security controls, and close coordination with the vendor for firmware updates. Countries with higher adoption of assistive mobility devices and strong healthcare infrastructure, such as Germany, France, the UK, and the Netherlands, are likely most affected. Immediate attention is critical to prevent potential harm to vulnerable users.
Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.
CVE-2025-66377 is a high-severity vulnerability in Pexip Infinity versions before 39.0, involving missing authentication on a critical internal API function. An attacker with code execution on one node of a Pexip Infinity installation can exploit this flaw to affect other nodes, potentially compromising confidentiality, integrity, and availability across the deployment. The vulnerability requires prior access to execute code on a node and has a CVSS score of 7.5, indicating high impact but with some exploitation complexity. There are no known exploits in the wild yet, and no patches have been linked at the time of publication. European organizations using Pexip Infinity for video conferencing and collaboration should prioritize mitigation to prevent lateral movement and broader compromise. Countries with significant Pexip Infinity deployments and strategic reliance on secure communications, such as the UK, Germany, France, and the Nordics, are most at risk. Mitigation should focus on restricting node access, network segmentation, and monitoring internal API calls, alongside prompt application of vendor updates once available.
