CVE-2026-90910 is a critical vulnerability in Apache Answer up to version 2.0.2 where the reaction API lacks proper authentication and content visibility controls. This flaw allows unauthorized users to read reaction metadata on restricted content and to add or remove their own reactions. The issue is fixed in version 2.0.3.
CVE-2026-108771 is a critical vulnerability in Apache Kylin versions 4.0.0 through 5.0.4 involving missing authentication for critical functionality. It includes an in-house broadcast and polymorphic deserialization flaw. The issue primarily impacts Kylin services exposed directly to public networks, which is uncommon, while typical in-house deployments are mostly unaffected. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Upgrading to version 5.0.5 resolves the issue.
CVE-2026-103091 is a critical vulnerability in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8. It involves missing authorization and insecure default initialization in the MCP proxy and OIDC registration flow, allowing remote attackers to self-enroll and gain full read, write, and execution access on backend services. The flaw arises because the GET /info endpoint publicly exposes OIDC configuration, and the POST /register endpoint auto-enrolls any valid OIDC token holder without claim filtering or ban checks. The default policy binds authenticated users to wildcard services and targets, enabling broad unauthorized access. The issue is fixed in version 0.1.0-alpha.9, which enforces stricter policy controls and ban checks.
Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 contain a critical vulnerability where the /libp2p-http ingress server lacks authentication and authorization checks. This flaw allows an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary backend services. The issue is fixed in version 0.1.0-alpha.3.
Dockhand versions prior to 1.0.34 have a critical vulnerability where the in-browser container terminal endpoint does not enforce authentication on WebSocket upgrade requests. This allows unauthenticated attackers with network access and knowledge of a container ID to execute commands inside that container, potentially leading to host compromise if the container has sensitive mounts or privileged execution. The issue is fixed in version 1.0.34.
CVE-2026-105667 is a vulnerability in J4Care's dcm4chee-arc-light version 5.35.1 where the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sender. This allows a remote attacker to reassign medical studies and workflow records from one patient to another. The archive's unmerge functionality does not reverse this reassignment. The vulnerability has a CVSS score of 7.5, indicating high severity.
CVE-2026-105279 is a critical vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The default configuration allows the archive to accept DICOM associations from unregistered calling AEs, enabling remote attackers to enumerate and retrieve patient information and medical images via C-FIND and C-GET commands. Additionally, attackers can use C-STORE to file fabricated study content under existing patient identities.
Apache Kylin versions 5.0.0 through 5.0.4 contain a critical SQL Injection vulnerability due to improper neutralization of special elements in SQL commands and missing authentication for a critical backend cache API. This flaw allows unauthenticated attackers to execute injected SQL commands, potentially compromising confidentiality, integrity, and availability. The issue primarily affects Kylin services exposed directly to public networks, which is uncommon in typical in-house deployments. Upgrading to version 5.0.5 resolves the vulnerability.
CVE-2026-105038 is a critical vulnerability in the EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services. These services expose AI model administration functions without requiring authentication, allowing unauthenticated remote attackers to change AI model configurations and switch the model in use at runtime. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-105034 is a high-severity vulnerability in the EnergizeLab NestJS auth service version 1.8.2. The service issues device tokens for arbitrary robot serial numbers without requiring authentication, allowing unauthenticated remote attackers to obtain valid device tokens and impersonate devices against cloud services.
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.
Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.
CVE-2026-39997 is a high-severity vulnerability in QNAP Systems Inc.'s HybridDesk Station where a missing authentication for a critical function could allow remote attackers to gain system access. The issue is fixed in version 4.2.22 and later.
CVE-2026-34006 is a critical vulnerability in QNAP Systems Inc.'s sMedio DTCP MOVE software caused by missing authentication for a critical function. This flaw allows remote attackers to gain unauthorized access to the system without any privileges or user interaction. The vulnerability has been fixed in version 1.4.5 and later.
CVE-2026-76659 is a high-severity vulnerability in the finger daemon component of Hewlett Packard Enterprise's HPE NonStop TCP/IP UTILITIES. It involves missing authentication for a critical function, which could allow an unauthenticated remote attacker to cause a denial of service (DoS). No confidentiality or integrity impact is reported. There is no information about affected versions or available patches.
CVE-2026-76656 is a medium severity vulnerability in Hewlett Packard Enterprise's HPE NonStop TCP/IP UTILITIES. It involves missing authentication for a critical function, specifically when the traceroute utility is executed under certain conditions. This flaw could allow an unauthenticated remote attacker to cause a denial of service (DoS) on the affected system.
FileRise Pro versions prior to 3.24.0 contain a vulnerability where the /api/pro/portals/get.php endpoint exposes sensitive internal client portal information to unauthenticated users who know or guess the portal slug. This includes internal storage paths, client emails, form settings, and upload policies. The issue requires the Pro add-on and at least one configured portal. It is fixed in version 3.24.0.
FileRise versions prior to 3.23.0 have a vulnerability that allows an authenticated attacker with a valid CSRF token to disable or enroll Time-based One-Time Password (TOTP) second factor authentication without recent full reauthentication. The enrollment endpoint prevents direct overwriting of an active TOTP secret but activates a newly generated secret before verifying possession. This flaw enables an attacker controlling an authenticated session to weaken or reset the second factor protection. The issue is fixed in version 3.23.0.
FileRise versions prior to 3.20.0 contain a vulnerability where the /api/file/snippet.php endpoint does not enforce an authenticated-session guard before processing short text preview requests. While the endpoint performs access control list (ACL) checks, unauthenticated requests can reach the ACL evaluation stage instead of being immediately rejected with a 401 response. Exploitation requires unusual proxy-header or ACL misconfiguration. This issue is fixed in version 3.20.0.
FileRise versions prior to 3.16.0 have a vulnerability where the application treats an empty or missing users.txt file as a fresh installation, allowing an unauthenticated remote attacker to create a new initial administrator account. This occurs because the application lacks a durable setup-complete marker independent of the user store. The issue is fixed in version 3.16.0.
OpenAEV-Platform versions prior to 2.260622.0 have a missing authentication vulnerability in the /api/player/** lessons endpoints. These endpoints accept a userId query parameter without verifying the caller's identity or membership in the exercise. This allows unauthenticated attackers who know an exercise UUID to read sensitive lesson content and impersonate users by creating or overwriting answers. The issue is fixed in version 2.260622.0.