Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,949

Export CSV
CVE-2026-127286

Zackriya-Solutions Meetily main.py missing authentication

A vulnerability was identified in Zackriya-Solutions Meetily up to 0.4.1. Affected is an unknown function of the file backend/app/main.py. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The legacy backend was not removed yet. Vulnerable code is still present on main. The vendor explains: "[W]e are moving towards a single unified application using the tauri framework, and we deprecated the client-server architecture of this application."

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zackriya-solutions
Products
Meetily
CVE-2026-127279

AIP-PUB ACPs-community Discovery Server main.py missing authentication

A vulnerability was detected in AIP-PUB ACPs-community up to 2.2.0. This impacts an unknown function of the file discovery-server/app/main.py of the component Discovery Server. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Aip-pub
Products
Acps-community
CVE-2026-0480

Missing Authentication in AMD SEV Firmware Enables Hypervisor to Forge Requests

Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to forge SEV-TIO guest request messages potentially compromising SEV-SNP guest memory integrity and confidentiality.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Amd
Products
Epyc 8005 Series Processors Epyc 9005 Series Processors Epyc Embedded 9005 Series Processors
CVE-2026-127275

Linksys EA8100 JNAP API ui_server.lua SetUnsecuredWiFiWarning missing authentication

A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredWiFiWarning of the file ui_server.lua of the component JNAP API. This manipulation of the argument isEnabled/enabled causes missing authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Linksys
Products
Ea8100
CVE-2026-127273

Linksys EA8100 JNAP API IsAdminPasswordDefault missing authentication

A vulnerability has been found in Linksys EA8100 1.0.3.216940. This affects the function GetWANStatus/GetWANStatus3/IsAdminPasswordDefault of the component JNAP API. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Linksys
Products
Ea8100
CVE-2026-119990

Azure OpenAI Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Open-ai
CVE-2026-71363

Awx: unauthenticated debug endpoints trigger scheduler operations

A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform
CVE-2026-121687

CVE-2026-121687

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication. 1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export. 2. ADB (Android Debug Bridge, port 5555) access to root shell 3. SSH (port 22)

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Frodobots
Products
Frodobots Earthrover Mini+ Firmware
CVE-2026-19706

Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap

During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access. Exploitable only during the narrow bootstrap window.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Assisted Installer Assisted Installer For Red Hat Openshift Container Platform Multicluster Engine and 3 more
CVE-2026-122987

Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability

Missing authentication for critical function in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Microsoft Hpc Pack 2016 Microsoft Hpc Pack 2019
CVE-2026-88245

Windows Brokering File System Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Brokering File System allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows Server 2025
CVE-2026-95947

Windows Error Reporting Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application. The security update addresses the vulnerability by correcting the way that WER handles and executes files.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more
CVE-2026-86502

Missing TLS and Authentication Allow Local Code Execution on JetBrains IntelliJ IDEA Remote Development gRPC Server

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2026-19422

Authentication Bypass

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.

CVSS 3.1 · 9.1 Critical EPSS 2.2% KEV · Not listed
Vendors
Zohocorp
Products
Ddi Central
CVE-2026-126795

ToolJet Onboarding Signup Endpoint util.service.ts activateUserWithPassword missing authentication

A vulnerability was determined in ToolJet up to 3.20.256-lts/3.21.93-beta. The impacted element is the function activateUserWithPassword of the file server/src/modules/onboarding/util.service.ts of the component Onboarding Signup Endpoint. Executing a manipulation of the argument email can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.21.94-beta is sufficient to resolve this issue. This patch is called af8f17a745621ae418f1743440f63d315e8b8643. The affected component should be upgraded. The vendor was contacted early about this disclosure.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tooljet
Products
Tooljet
CVE-2026-126759

H3C ICG2000 Unified Communication Gateway Web Management check.j missing authentication

A flaw has been found in H3C ICG2000 Unified Communication Gateway 2023. This issue affects some unknown processing of the file /wnm/check.j of the component Web Management Module. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. The researcher claims that the vendor has acknowledged receipt of the vulnerability report. No further response has been received.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
H3c
Products
Icg2000 Unified Communication Gateway