CVE-2026-61740

LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset, X-API-Key protection can be bypassed because lightrag/api/auth.py falls back to a hardcoded DEFAULT_TOKEN_SECRET, /auth-status and /login can mint guest JWTs, and combined_dependency in lightrag/api/utils_api.py accepts a valid guest token before checking the API key. A remote unauthenticated attacker can call endpoints guarded by combined_auth, including document read, upload, deletion, graph mutation, and query endpoints. This vulnerability is fixed in 1.5.4.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hkuds

Products

Lightrag

CVE-2026-56400

open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests from attacker-controlled websites when an admin user visits them.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Openwebui

Products

Open Webui

CVE-2026-45063

Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Sensiolabs Symfony

Products

Symfony Symfony

CVE-2022-50994

DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter. Attackers can exploit unsanitized input passed to the otp_check.sh script to achieve remote code execution with web server privileges. Exploitation requires knowledge of a valid username and that the target account has MOTP authentication enabled.

CVSS 4.0 · 9.2 Critical EPSS 1.4% KEV · Not listed

Vendors

Draytek

Products

Vigor 2960

CVE-2022-50993

Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet

Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC).

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Weaver

Products

E-office

CVE-2022-50972

WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Woocommerce Wordpress

Products

Woocommerce Wordpress

CVE-2021-47932

WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler. Attackers can send POST requests to the tcp_register_and_login_ajax action with tcp_role set to administrator to gain full administrative access without authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Thecartpress Wordpress

Products

Thecartpress Wordpress

CVE-2021-47708

COMMAX Smart Home IoT Control System SQL Injection Authentication Bypass

COMMAX Smart Home System CDP-1020n contains an SQL injection vulnerability that allows attackers to bypass authentication by injecting arbitrary SQL code through the 'id' parameter in 'loginstart.asp'. Attackers can exploit this by sending a POST request with malicious 'id' values to manipulate database queries and gain unauthorized access.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Bosch Commax

Products

Smart Home Smart Home System

CVE-2020-37071

CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download functionality with a specially crafted request.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Craft Cms Craftcms

CVE-2019-25763

WordPress Ultimate Addons for Beaver Builder 1.2.4.1 Authentication Bypass

WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a valid administrator email address, and a valid nonce to obtain session cookies and authenticate as that user.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Brainstormforce Ultimatebeaver Wordpress

Products

Ultimate Addons For Beaver Builder Ultimate Addons For Beaver Builder Wordpress

CVE-2019-25651

Ubiquiti UniFi Devices Use of AES-CBC Allows Key Recovery and Unauthorized Device Control

Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vulnerabilities to derive the encryption keys, enabling unauthorized control and management of network devices.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Ubiquiti Ui

Products

Unifi Uap-ac Firmware Unifi Uap Firmware Unifi Usg Firmware and 3 more

CVE-2019-25487

SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmd

SAPIDO RB-1732 V2.0.43 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the formSysCmd endpoint. Attackers can send POST requests with the sysCmd parameter containing shell commands to execute code on the device with router privileges.

CVSS 4.0 · 9.3 Critical EPSS 9.0% KEV · Not listed

Vendors

Sapido

Products

Rb-1732

CVE-2019-25278

FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM Disclosure

FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to intercept authentication credentials. Attackers can perform man-in-the-middle attacks to capture HTTP cookie authentication information during network communication.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Iwt

Products

Facesentry Access Control System Facesentry Access Control System Firmware

CVE-2018-25317

Tenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS Change

Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

A302 A302 Firmware W3002r and 3 more

CVE-2018-25316

Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change

Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

W308r W308r Firmware

CVE-2018-25236

Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Belden

Products

Hirschmann Hios Hirschmann Hisecos

CVE-2017-20229

MAWK 1.3.3-17 Stack-Based Buffer Overflow

MAWK 1.3.3-17 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting inadequate boundary checks on user-supplied input. Attackers can craft malicious input that overflows the stack buffer and execute a return-oriented programming chain to spawn a shell with application privileges.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Invisible-island Mawk

Products

Mawk Mawk

CVE-2014-125126

Simple E-Document Arbitrary File Upload RCE

An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header (access=3) with HTTP requests. The application’s upload mechanism fails to restrict file types and does not validate or sanitize user-supplied input, allowing attackers to upload malicious .php scripts. Authentication can be bypassed entirely by supplying a specially crafted cookie (access=3), granting access to the upload functionality without valid credentials. If file uploads are enabled on the server, the attacker can upload a web shell and gain remote code execution with the privileges of the web server user, potentially leading to full system compromise.

CVSS 4.0 · 9.2 Critical EPSS 2.0% KEV · Not listed

Vendors

Tecorange

Products

Simple E-document

CVE-2012-10055

ComSndFTP v1.3.7 Beta USER Format String RCE

ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory (specifically WSACleanup from Ws2_32.dll). This allows the attacker to redirect execution flow and bypass DEP protections using a ROP chain, ultimately leading to arbitrary code execution. The vulnerability is exploitable without authentication and affects default configurations.

CVSS 4.0 · 9.3 Critical EPSS 2.6% KEV · Not listed

Vendors

Cerberusftp Comsndftp

Products

Ftp Server Ftp Server

CVE-2012-10026

WordPress Plugin Asset-Manager <= 2.0 PHP File Upload

The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.

CVSS 4.0 · 10 Critical EPSS 2.0% KEV · Not listed

Vendors

Asset-manager Hp Wordpress

Products

Asset-manager Wordpress Plugin Asset Manager Wordpress