Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,325

Export CSV
CVE-2026-85424

MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR

MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Themoos
Products
Core-moos
CVE-2026-108071

Improper Multi-Factor Authentication Validation Allows Authentication Bypass

Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tsplus
Products
Tsplus Remote Access
CVE-2026-85428

MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write

MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables including actuator and override commands without authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Themoos
Products
Core-moos
CVE-2026-103905

Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which deactivates all installed plugins and their functionality, such as payment and shipping integrations, resulting in a shop-wide denial of service. The attack requires a single request and can be automated against many installations.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108739

OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces

OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabric_api_key in each workspace's settings map, along with workspace ids, slugs, creator emails and member lists.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Openagents-org
Products
Openagents
CVE-2022-2503

Linux Kernel LoadPin bypass via dm-verity table reload

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus and 1 more
CVE-2026-76268

Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Splunk Enterprise versions 10.0.x and 9.4.x are not affected.

CVSS 3.1 · 9.8 Critical EPSS 5.7% KEV · Not listed
Vendors
Splunk
Products
Splunk Splunk Enterprise
CVE-2026-87689

Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Metasploit
Products
Metasploit Framework
CVE-2026-85972

Improper Kerberos server verification in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2021-22890

curl: TLS 1.3 session ticket mix-up with HTTPS proxy host

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

CVSS 3.1 · 4.3 Medium EPSS 3.1% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 6 more
Products
Fabric Operating System Debian Linux Fedora and 9 more
CVE-2020-13529

systemd: DHCP FORCERENEW authentication not implemented can cause a system running the DHCP client to have its network reconfigured

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Netapp Redhat and 1 more
Products
Fedora Active Iq Unified Manager Cloud Backup and 2 more
CVE-2019-1010022

glibc: stack guard protection bypass

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Gnu
Products
Glibc
CVE-2026-107824

x64dbg-MCP Server exposes debugger operations to unauthenticated network clients

x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated network client that can reach the default port, 9094 for x64 or 9095 for x32, can execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. This issue is fixed in version 1.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Duty1g
Products
X64dbg-mcp-server
CVE-2026-108263

Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Iflytek
Products
Astron-agent
CVE-2026-106043

Remote Unauthenticated Modification of Trusted Site Entries in Ivanti Xtraction

A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ivanti
Products
Xtraction
CVE-2026-108580

AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login

AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Phoenixthrush
Products
Aniworld Downloader
CVE-2026-87659

Fabric OS Authorization Bypass via Crafted CT Requests

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Broadcom Brocade
Products
Fabric Operating System Fabric Os
CVE-2026-78025

Missing Authentication in Dell Secure Connect Gateway Policy Manager Allows Unauthorized Access

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass, and Unauthorized access.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager
CVE-2026-109949

FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-108757

Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts into the user's main OpenClaw agent session as user instructions.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Nexting
Products
Pinclaw