Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,949

Export CSV
CVE-2026-75128

Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).

CVSS 4.0 · 9.3 Critical EPSS 2.2% KEV · Not listed
Vendors
Chatchat-space
Products
Langchain-chatchat
CVE-2026-63690

Missing Authentication in Dell Container Storage Modules Causing Information Disclosure

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Container Storage Modules
CVE-2026-77932

DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Dbgpt Eosphoros-ai
Products
Db-gpt Db-gpt
CVE-2026-70411

Unauthorized Tenant Creation and Privilege Escalation via Missing Authentication in Dell Container Storage Modules

Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized creation of tenant entities, cross-tenant role injection, and modification of storage access control flags.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Container Storage Modules
CVE-2026-90910

Apache Answer: Reaction API authorization bypass for restricted content

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Answer Apache Answer
CVE-2026-112143

satya-vinay Events-Management-System missing authentication

A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Satya-vinay
Products
Events-management-system
CVE-2026-112016

Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files

Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into /tmp/boa_temp.update or /tmp/boa_temp.para, tampering with pending firmware updates or configuration restores or causing denial of service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Netcore
Products
Nr256cn
CVE-2026-111870

itsmeravitejak Online-Examination-System admin.php isAdmin missing authentication

A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Itsmeravitejak
Products
Online-examination-system
CVE-2026-111660

waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wayn111
Products
Waynboot-mall
CVE-2026-105034

EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Nestjs Auth Service
CVE-2026-105038

EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Energizelab
Products
Fastapi Ai Inference Server
CVE-2026-105279

J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
J4care
Products
Dcm4chee-arc-light
CVE-2026-105667

J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
J4care
Products
Dcm4chee-arc-light
CVE-2026-111617

WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mgdaaslab
Products
Wharttest
CVE-2026-111626

Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers

Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Webreaper
Products
Damselfly
CVE-2026-111661

waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wayn111
Products
Waynboot-mall
CVE-2026-18941

Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Openshift Ai (rhoai) Openshift Ai
CVE-2026-57492

FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Error311
Products
Filerise
CVE-2026-77096

CVFS Missing Authentication

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-104110

FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.24.0, FileRise Pro /api/pro/portals/get.php returns a configured client portal's full internal record to an unauthenticated caller who knows or guesses the portal slug. The response includes the internal storage folder path, client contact email, form settings, and upload-policy details, while the separate publicMeta.php endpoint intentionally exposes only curated branding data. Exploitation requires the Pro add-on and at least one configured portal. This issue is fixed in version 3.24.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Error311
Products
Filerise