CVE-2026-84249

IBM Guardium Data Protection is affected by vulnerability

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Guardium Data Protection

CVE-2026-62253

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Sipcapture

Products

Homer

CVE-2026-107231

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest while omitting or emptying the nonce, causing the client to resend the username and password using reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed in versions 3.0.13 and 2.16.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Asynchttpclient Project

Products

Async-http-client

CVE-2026-107151

Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests

Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Satellite 6 Satellite

CVE-2026-75597

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pyload

Products

Pyload

CVE-2026-103956

Missing authentication for critical function in Loom for AWS

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.

CVSS 4.0 · 10 Critical EPSS 2.5% KEV · Not listed

Vendors

Aws

Products

Loom

CVE-2026-57967

Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Activemq Artemis Artemis

CVE-2026-77900

Azure App Service Remote Code Execution Vulnerability

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure App Service

CVE-2026-11318

Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Zuler Technology

Products

Deskin

CVE-2026-104076

TVU Networks Receiver/Transceiver Missing Authentication via REST API

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud service information, or issue POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS to alter DNS settings and enable man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tvu Networks

Products

Tvu Receiver / Transceiver

CVE-2026-106511

CVE-2026-106511

MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Multiversx Labs

Products

Multisig-improved

CVE-2026-102159

Security Advisory 0190

An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Cue

CVE-2025-70516

WebSocket Authentication Bypass in Fanvil X7A Firmware 2.6.0.1182

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Fanvil

Products

X7a

CVE-2026-105110

Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.

CVSS 4.0 · 9.3 Critical EPSS 3.0% KEV · Not listed

Vendors

Iskratel

Products

Innbox

CVE-2026-107279

AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Asynchttpclient Project

Products

Async-http-client

CVE-2026-63692

Missing Authentication Enabling Remote Privilege Escalation in Dell Container Storage Modules

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Container Storage Modules

CVE-2026-106038

Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and request failures.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Kvcache-ai

Products

Mooncake

CVE-2026-105835

PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Planka

Products

Planka

CVE-2026-15688

Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting

Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modifying part of the executable module in memory, and thereby may be able to view, tamper with, destroy, or delete control programs.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Mitsubishielectric

Products

Gx Works3 Motion Control Setting

CVE-2026-107206

LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Lmcache

Products

Lmcache