Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,949

Export CSV
CVE-2026-27603

Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the chart filter endpoint POST /project/:project_id/chart/:chart_id/filter is missing both verifyToken and checkPermissions middleware, allowing unauthenticated users to access chart data from any team/project. This issue has been patched in version 4.8.4.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Chartbrew Depomo
Products
Chartbrew Chartbrew
CVE-2026-22731

Authentication Bypass under Actuator Health groups paths

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Boot Spring Boot
CVE-2026-35584

FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the given conversation_id. This allows any unauthenticated attacker to mark any thread as read by passing arbitrary IDs, enumerate valid thread IDs via HTTP response codes (200 vs 404), and manipulate opened_at timestamps across conversations (IDOR). This vulnerability is fixed in 1.8.212.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Freescout Freescout Helpdesk
Products
Freescout Freescout
CVE-2026-26235

JUNG Smart Visu Server 1.1.1050 - 'JUNG Smart Visu Server' Missing Authentication

JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or reboot the server. Attackers can send a single POST request to trigger the server reboot without requiring any authentication.

CVSS 4.0 · 8.7 High EPSS 1.9% KEV · Not listed
Vendors
Albrecht Jung Jung-group
Products
Jung Smart Visu Server Smart Visu Server Smart Visu Server Firmware
CVE-2026-27584

ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction information. This vulnerability allows an unauthenticated attacker to read the bank account balance and transaction history of ActualBudget users. This vulnerability impacts all ActualBudget Server users with the SimpleFIN or Pluggy.ai integrations configured. The ActualBudget Server instance must be reachable over the network. Version 26.2.1 patches the issue.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Actualbudget
Products
Actual
CVE-2026-26340

Tattile Smart+ / Vega / Basic <= 1.181.5 Unauthenticated RTSP Stream Disclosure

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Iptime Tattile
Products
Smart Firmware Anpr Mobile Anpr Mobile Firmware and 22 more
CVE-2026-27595

Parse Dashboard has incomplete authentication on AI Agent endpoint

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (POST `/apps/:appId/agent`) has multiple security vulnerabilities that, when chained, allow unauthenticated remote attackers to perform arbitrary read and write operations against any connected Parse Server database using the master key. The agent feature is opt-in; dashboards without an agent config are not affected. The fix in version 9.0.0-alpha.8 adds authentication, CSRF validation, and per-app authorization middleware to the agent endpoint. Read-only users are restricted to the `readOnlyMasterKey` with write permissions stripped server-side. A cache key collision between master key and read-only master key was also corrected. As a workaround, remove or comment out the agent configuration block from your Parse Dashboard configuration.

CVSS 4.0 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Parse Community Parseplatform
Products
Parse Dashboard Parse Dashboard
CVE-2018-25241

VPN Browser+ 1.1.0.0 Denial of Service

VPN Browser+ 1.1.0.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of characters into the search bar to trigger an unhandled exception that terminates the application.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Vpn Browser+
CVE-2018-25246

Wikipedia 12.0 Denial of Service via Search

Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of repeated characters into the search bar to trigger an application crash.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Wikipedia
Products
Wikipedia
CVE-2026-21767

HCL BigFix Platform is affected by insufficient authentication

HCL BigFix Platform is affected by insufficient authentication.  The application might allow users to access sensitive areas of the application without proper authentication.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Platform
CVE-2026-25851

Chargemap chargemap.com Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Chargemap
Products
Chargemap.com
CVE-2026-24731

EV2GO ev2go.io Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ev2go
Products
Ev2go.io
CVE-2026-27772

EV Energy ev.energy Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ev.energy Ev Energy
Products
Ev.energy Ev.energy
CVE-2026-28352

Indico missing access check in event series management API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cern Indico
Products
Indico Indico
CVE-2026-2844

TimePictra Authentication Bypass Vulnerability

Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Microchip
Products
Timepictra
CVE-2026-1775

Missing Authentication for Critical Function in Labkotec LID-3300IP

The Labkotec LID-3300IP has an existing vulnerability in the ice detector software that enables an unauthenticated attacker to alter device parameters and run operational commands when specially crafted packets are sent to the device.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Labkotec
Products
Lid-3300ip Lid-3300ip Type 2
CVE-2026-32985

Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution

Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.

CVSS 4.0 · 9.3 Critical EPSS 1.5% KEV · Not listed
Vendors
Apereo Xerte
Products
Xerte Online Toolkits Xerte Online Toolkits
CVE-2026-28450

OpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints

OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import that allow reading and modifying Nostr profiles without gateway authentication. Remote attackers can exploit these endpoints to read sensitive profile data, modify Nostr profiles, persist malicious changes to gateway configuration, and publish signed Nostr events using the bot's private key when the gateway HTTP port is accessible beyond localhost.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-28468

OpenClaw 2026.1.29-beta.1 < 2026.2.14 - Authentication Bypass in Sandbox Browser Bridge Server

OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox browser bridge server in which it accepts requests without requiring gateway authentication, allowing local attackers to access browser control endpoints. A local attacker can enumerate tabs, retrieve WebSocket URLs, execute JavaScript, and exfiltrate cookies and session data from authenticated browser contexts.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw