Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,949

Export CSV
CVE-2026-35388

OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-34758

OneUptime: Missing Authentication on Notification Endpoints

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Hackerbay Oneuptime
Products
Oneuptime Oneuptime
CVE-2026-34227

Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser. This issue has been patched in version 1.7.4.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Bishopfox
Products
Sliver
CVE-2026-5320

vanna-ai vanna Chat API Endpoint v2 missing authentication

A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is an unknown functionality of the file /api/vanna/v2/ of the component Chat API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vanna-ai
Products
Vanna
CVE-2026-3207

TIBCO BPM Enterprise Remote Code Execution (RCE) Vulnerability

Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tibco
Products
Bpm Enterprise
CVE-2018-25224

PMS 0.42 Stack-Based Buffer Overflow via Configuration File

PMS 0.42 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious values in the configuration file. Attackers can craft configuration files with oversized input that overflows the stack buffer and execute shell commands via return-oriented programming gadgets.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Kimtore Pms
Products
Practical Music Search Pms
CVE-2026-24068

Missing XPC Client & NSXPC endpoint validation leads to privilege escalation in Vienna Assistant (MacOS) - Vienna Symphonic Library

The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate clients at all. This means that any process can connect to this service using the configured protocol. A malicious process is able to call all the functions defined in the corresponding HelperToolProtocol. No validation is performed in the functions "writeReceiptFile" and “runUninstaller” of the HelperToolProtocol. This allows an attacker to write files to any location with any data as well as execute any file with any arguments. Any process can call these functions because of the missing XPC client validation described before. The abuse of the missing endpoint validation leads to privilege escalation.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Vienna Symphonic Library
Products
Vienna Assistant
CVE-2026-34731

AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo on_publish_done.php endpoint in the Live plugin allows unauthenticated users to terminate any active live stream. The endpoint processes RTMP callback events to mark streams as finished in the database, but performs no authentication or authorization checks before doing so. An attacker can enumerate active stream keys from the unauthenticated stats.json.php endpoint, then send crafted POST requests to on_publish_done.php to terminate any live broadcast. This enables denial-of-service against all live streaming functionality on the platform. At time of publication, there are no publicly available patches.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wwbn
Products
Avideo
CVE-2026-34732

AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo CreatePlugin template for list.json.php does not include any authentication or authorization check. While the companion templates add.json.php and delete.json.php both require admin privileges, the list.json.php template was shipped without this guard. Every plugin that uses the CreatePlugin code generator inherits this omission, resulting in 21 unauthenticated data listing endpoints across the platform. These endpoints expose sensitive data including user PII, payment transaction logs, IP addresses, user agents, and internal system records. At time of publication, there are no publicly available patches.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wwbn
Products
Avideo
CVE-2026-20995

Unauthorized Remote Configuration Modification in Samsung Smart Switch

Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Samsung
Products
Smart Switch
CVE-2025-15517

Authorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600

A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.

CVSS 4.0 · 8.6 High EPSS 2.9% KEV · Not listed
Vendors
Tp-link
Products
Archer Nx200 Archer Nx200 Firmware Archer Nx200 V1.0 and 16 more
CVE-2026-3527

AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022

Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ceriumsoft Drupal
Products
Ajax Dashboard Ajax Dashboard
CVE-2026-34162

FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers, and body, then makes a server-side HTTP request and returns the complete response to the caller. This issue has been patched in version 4.14.9.5.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Fastgpt Labring
Products
Fastgpt Fastgpt
CVE-2026-3356

Missing Authentication for Critical Function vulnerability in Anritsu Remote Spectrum Monitor

The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its management interface. Because the device provides no mechanism to enable or configure authentication, the issue is inherent to its design rather than a deployment error.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Anritsu
Products
Remote Spectrum Monitor Ms27100a Remote Spectrum Monitor Ms27101a Remote Spectrum Monitor Ms27102a and 1 more
CVE-2026-34411

Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs

Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains for reconnaissance and targeted attack planning.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Appsmith
Products
Appsmith
CVE-2026-1724

Missing Authentication for Critical Function in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access control.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2026-33413

etcd: Authorization bypasses in multiple APIs

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, unauthorized users may bypass authentication or authorization checks and call certain etcd functions in clusters that expose the gRPC API to untrusted or partially trusted clients. In unpatched etcd clusters with etcd auth enabled, unauthorized users are able to call MemberList and learn cluster topology, including member IDs and advertised endpoints; call Alarm, which can be abused for operational disruption or denial of service; use Lease APIs, interfering with TTL-based keys and lease ownership; and/or trigger compaction, permanently removing historical revisions and disrupting watch, audit, and recovery workflows. Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected. Versions 3.4.42, 3.5.28, and 3.6.9 contain a patch. If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in practice. Restrict network access to etcd server ports so only trusted components can connect and/or require strong client identity at the transport layer, such as mTLS with tightly scoped client certificate distribution.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Etcd
Products
Etcd
CVE-2026-33159

Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest users can access Config Sync updater index, obtain signed data, and execute state-changing Config Sync actions (regenerate-yaml, apply-yaml-changes) without authentication. This issue has been patched in versions 4.17.8 and 5.9.14.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Craft Cms Craftcms
CVE-2019-25632

phpFileManager 1.7.8 Local File Inclusion via index.php

phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm_current_dir, and filename parameters. Attackers can send GET requests to index.php with crafted parameter values to access sensitive files like /etc/passwd from the server.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Dulldusk Sourceforge
Products
Phpfilemanager Phpfilemanager
CVE-2026-32326

Unauthorized Access to Sharp 5G Routers via Unauthenticated Web APIs

SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sharp
Products
5g Mobile Router Sh-u01 Home 5g Hr01 Home 5g Hr02 and 5 more