CVE-2026-123278 is a vulnerability in JetBrains IntelliJ IDEA before version 2026.3 that allows code execution through an unauthenticated JDBC worker RMI endpoint. This flaw involves missing authentication for critical functionality, enabling potential unauthorized remote code execution. The issue is fixed in version 2026.3.
CVE-2026-123277 is a vulnerability in JetBrains CLion before version 2026.3 where missing authentication allowed local users on Linux systems to access the debug session environment. This flaw affects versions prior to 2026.3 and has been assigned a medium severity rating with a CVSS score of 5. The issue is fixed in version 2026.3.
CVE-2026-110390 is a vulnerability in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite. It involves missing authentication for critical functionality, allowing unauthenticated remote attackers to access Beacon policy and targeting information when anonymous web server access is enabled, which is the default setting. This issue affects versions prior to 26.4.1 and version 0. A fix is available in version 26.4.1 and later releases.
CVE-2026-111493 is a high-severity vulnerability in TPC Software's Matchpoint product involving missing authentication on the Images.ashx endpoint. This flaw allows unauthenticated remote attackers to download profile photos by enumerating predictable identifiers. The vulnerability could lead to privacy breaches by exposing user photos, potentially linked to identities through other platform weaknesses.
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured site database. An unauthenticated network actor can obtain site identifiers, database names, site names, exact OpenEMR versions and patch levels, pending upgrade status, and direct login and patient-portal links. This issue is fixed in version 8.3.0.
OpenHuman versions prior to 0.57.44 have a security vulnerability in the local /ws/dictation WebSocket endpoint, which lacks client authentication and browser-origin validation. This allows unauthenticated clients, including malicious web pages, to submit audio and trigger resource-intensive speech-to-text processing. Earlier versions also have an unbounded audio buffer, enabling continuous streaming that can exhaust process memory and degrade or crash the application. The issue is fixed in version 0.57.44.
OpenHuman versions before 0.56.0 have an authentication bypass vulnerability in the Socket.IO handlers. While HTTP POST requests to /rpc are protected by bearer token middleware, the Socket.IO rpc:request and chat:start handlers lack equivalent authentication. This allows a local unauthenticated client to connect and invoke sensitive operations such as reading configuration or health data, starting agent flows, interacting with account APIs, modifying local data, or stopping and restarting services. The issue is fixed in version 0.56.0.
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser access, and uses only a caller-supplied client_id to select WebChannelEvent objects from the process-wide event bus. An unauthenticated local client, or an attacker-hosted web page opened by the victim, can subscribe to another client's stream by supplying a known or guessed identifier; the fixed system identifier makes the proactive-message stream predictable. The exposed events can include complete assistant responses, streamed message content, tool names, tool arguments, and raw tool outputs intended for the local user interface. This issue is fixed in version 0.56.0.
CVE-2026-121139 is a missing authentication vulnerability in the Rapid7 Metasploit Framework's msf-ws REST API. The API allows unauthenticated creation of the first administrator user when the users table is empty due to a bootstrap exemption. This occurs because the authentication check short-circuits before verifying administrator privileges if the system is not yet initialized. The issue is fixed in version 6.5.9.
Apache OFBiz versions prior to 24.09.08 contain a vulnerability in the REST API framework's ModelApiReader parser. Due to an incorrect default value for the auth attribute in .rest.xml definitions, unauthenticated remote attackers can invoke REST API operations without valid credentials. This occurs because ModelApiReader incorrectly treats the missing auth attribute as false, allowing unauthorized access. The issue is fixed in version 24.09.08.
Telepresence versions prior to 2.31.0 contain a vulnerability in the Traffic Manager gRPC API that allows unauthenticated callers within the cluster network to register in any managed namespace and create service intercepts without proper Kubernetes RBAC checks. This flaw enables an attacker with network access to the manager pod to intercept traffic and access sensitive container environment data, including secrets and tokens. The issue is fixed in version 2.31.0.
SharpEmu versions up to 0.0.3-release.3 are vulnerable due to missing authentication on its debugger frontend HTTP API running on localhost. This API lacks validation of critical headers and accepts cross-origin requests, allowing attackers with local network access to perform debugger operations, launch executables, and initiate outbound connections. The vulnerability is fixed in version 0.0.3-release.3-patch.1.
A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.
Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attackers can connect to the affected device's ADB service and obtain an ADB shell, thereby accessing device resources or performing related operations.
CVE-2026-92188 is a critical vulnerability in Quest Foglight for Databases version 8.2.0. It involves missing authentication in the ForgeMBeanServerSupport module, allowing remote attackers to execute arbitrary code without any authentication. This flaw enables code execution with SYSTEM privileges, posing a severe security risk.
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1.
A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying fields of a GlobalRole. As a result, a non-administrative user could be granted, through a global role binding, permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1.
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.
CVE-2026-63399 is a vulnerability in roostorg's open source tool Coop prior to version 1.0.0. The GraphQL Mutation.createOrg operation allows unauthenticated users to create arbitrary organizations on publicly accessible instances. This can generate excessive log noise and, due to lack of rate limiting, may lead to database exhaustion. The issue is resolved in version 1.0.0. Running the service on an authenticated private network can mitigate exposure by preventing unauthorized external access to the GraphQL API.
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api/routers/auth.py` allows an unauthenticated network attacker to create the first administrator account before the legitimate owner completes initial setup. The `initial_setup` function checks only the `is_setup` completion flag and requires no authentication, one-time bootstrap token, or network restriction. The default `docker-compose.yml` publishes port 8001 on all interfaces, the `Dockerfile` starts the listener on 0.0.0.0, and `src/api/main.py` mounts the authentication router without a global authentication guard. The endpoint invokes `create_auth_user` with `UserRole.ADMIN` and `set_auth_cookie`, issuing a valid `fctr_session` JWT cookie. Localhost-only CORS rules do not restrict non-browser HTTP clients, and the setup operation does not require access to a real Okta tenant. The attacker becomes the sole administrator and prevents legitimate first-run setup, can read Okta-synced user data, API tokens, chat history, and application configuration, modify users and Okta integration credentials, and lock out administrators or disable the service. Already completed setup is rejected. This issue is fixed in version 3.0.1-beta.