Dgraph version prior to 25.4.0 has an unauthenticated administrative HTTP interface exposed on port 6080. This interface allows unauthenticated attackers to read cluster state, allocate IDs, and perform destructive membership operations such as removing nodes. Exploitation can disrupt the Zero control plane and destabilize Alpha nodes, resulting in denial of service. The vulnerability arises because administrative endpoints lack authentication or IP whitelisting by default.
A path traversal vulnerability exists in dbt-labs dbt-core versions from 2.0.0-alpha.0 up to but not including 2.0.0-alpha.5. The dbt docs serve component exposes an unauthenticated POST /api/v1/query endpoint that allows clients to execute SQL queries via DuckDbViewsBackend without authorization or an allowlist. This enables reading of arbitrary files accessible to the dbt process, including files outside the intended docs index directory. The server binds to localhost by default but can be exposed to a network, increasing risk. The issue is fixed in version 2.0.0-alpha.5.
flytohub flyto-core versions 2.26.2 and 2.26.3 contain a command injection vulnerability in the HTTP MCP POST /mcp route. This flaw allows unauthenticated JSON-RPC calls to execute arbitrary shell commands via the sandbox.execute_shell module, potentially leading to full OS command execution with the privileges of the flyto-core server process. The issue is resolved in version 2.26.4.
CVE-2026-16740 is a critical vulnerability in TR7 Cyber Defense Inc.'s TR7 ASP product on both virtual and physical appliances. It involves missing authentication for a critical function, which allows an attacker to perform OS command injection. The affected versions are from 1.0.40.236 up to but not including 1.0.1554.2331, and from 1.6.42.239 up to but not including 1.6.1554.2331. The vulnerability has a CVSS 3.1 score of 9.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or remediation information is provided in the input data.
CVE-2026-103905 is a vulnerability in the JTL-Shop administration backend where the plugin safe mode toggle can be accessed without authentication. This allows an unauthenticated remote attacker to enable or disable the shop's plugin safe mode, effectively deactivating all installed plugins including payment and shipping integrations. The vulnerability leads to a denial of service affecting the entire shop. It requires only a single request and can be automated against multiple installations.
CVE-2026-108473 is a high-severity vulnerability in TP-Link Systems Inc. HS103 v5 devices involving missing authentication for critical functions in the local device-management protocol. An unauthenticated attacker on an adjacent network can send management commands without proper authentication, potentially modifying device state or settings. Additionally, under certain conditions involving user, mobile app, and cloud interactions, account-related information may be exposed, risking cloud account compromise.
CVE-2026-97793 is a vulnerability in Microsoft Windows 10 Version 1809 and related builds where missing authentication for a critical function in Windows Setup and Deployment allows a local authorized attacker to elevate privileges. The flaw affects multiple Windows 10 versions prior to their respective fixed releases. A patch is available from Microsoft to address this issue.
CVE-2026-96858 is a vulnerability in Microsoft Windows 10 Version 21H2 involving missing authentication for a critical function in the Windows Security Account Manager. This flaw allows an authorized local attacker to perform tampering without proper authentication. The issue affects multiple builds of Windows 10 21H2 prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-85884 is a high-severity vulnerability in Microsoft Windows 11 Version 24H2 involving missing authentication for a critical function in the Windows Health and Optimized Experiences Service. This flaw allows a locally authorized attacker to elevate privileges. The vulnerability affects multiple builds of Windows 11 24H2 prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-83656 is a vulnerability in Microsoft Windows 10 Version 21H2 involving missing authentication for a critical function in Windows Modern Device Management (MDM). This flaw allows an authorized local attacker to perform tampering. The issue affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-62879 is a vulnerability in Microsoft Windows 10 Version 1809 involving missing authentication for a critical function in Windows SmartScreen. This flaw allows an authorized local attacker to perform tampering. The issue affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-96313 is a vulnerability in Microsoft Windows 10 Version 1809 involving missing authentication for a critical function in Windows Push Notifications. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-70137 is a vulnerability in Microsoft Windows 10 Version 1607 and related versions involving improper access control in the Windows Remote Access Connection Manager. This flaw allows an authorized attacker with local access to disclose sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released to address this issue.
CVE-2026-83928 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related versions. It involves an out-of-bounds write in the Local Security Authority Subsystem Service (LSASS) that allows an unauthorized attacker to execute code remotely over a network. The vulnerability is due to missing authentication for critical functionality (CWE-306). Official fixes have been released for all affected versions.
CVE-2026-83854 is a vulnerability in Microsoft Windows 10 Version 1809 involving improper access control in the Windows Notification component. It allows an authorized attacker with local access to disclose information without user interaction. The vulnerability has a medium severity score of 5.5 and has been officially fixed in multiple Windows 10 builds.
CVE-2026-83715 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds, involving missing authentication for a critical function in Windows Error Reporting. This flaw allows an authorized local attacker to tamper with the system. The vulnerability affects multiple Windows 10 versions prior to their respective fixed releases. An official fix is available from Microsoft.
CVE-2026-83654 is a vulnerability in Microsoft Windows 10 Version 21H2 involving missing authentication for a critical function in Windows Modern Device Management (MDM). This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple builds of Windows 10 21H2 and related versions prior to specific fixed builds. A patch is officially available from Microsoft.
CVE-2026-70580 is a high-severity vulnerability in Microsoft Windows 10 Version 1809 involving missing authentication for a critical function in Windows Credential Guard. This flaw allows an authorized local attacker to perform spoofing attacks. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-96183 is a vulnerability in Microsoft Windows 11 Version 24H2 involving missing authentication for a critical function in the Windows Health and Optimized Experiences Service. This flaw allows an authorized local attacker to disclose sensitive information. The issue affects specific builds prior to fixed versions released by Microsoft. A patch is available and has been officially released to address this vulnerability.
CVE-2026-105728 is a high-severity vulnerability in Microsoft Dynamics NAV 2018 caused by missing authentication for critical functionality. This flaw allows unauthorized attackers to disclose sensitive information over a network. The issue affects versions from 1.0 up to but not including 11.0.50736.0. Microsoft has released an official fix in version 11.0.50736.0 to address this vulnerability.