CVE-2026-59786

Active agent heartbeat missing TLS check

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zabbix

Products

Zabbix

CVE-2026-80276

Comelit 1456B gateway exposes remote configuration password via unauthenticated management interface

Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through this interface, sensitive device configuration data - including the Remote Configuration Password - can be read in cleartext by a remote, unauthenticated attacker.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Comelit Group

Products

1456b Multi-user Gateway

CVE-2026-97363

Monta monta.app Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Monta

Products

Monta.app

CVE-2026-95102

Monta monta.app Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Monta

Products

Monta.app

CVE-2026-76594

advisor-backend: advisor-backend: Unauthenticated /private/import_content/ endpoint allows global rule-catalogue overwrite

A flaw was found in advisor-backend. A network-adjacent unauthenticated attacker could exploit a vulnerability in the `/private/import_content/` endpoint, which lacks proper authentication and permission checks. This allows the attacker to overwrite the global Advisor rule, resolution, and playbook catalogue. When combined with another vulnerability involving unsafe YAML deserialization, this could lead to arbitrary code execution on affected systems.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed

Vendors

Advisor-backend

Products

Advisor-backend

CVE-2026-90449

Missing Authentication for Critical Function in Malcolm

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which manages the credential store used to gate every other service in the deployment, is delegated entirely to that third-party interface's own login mechanism. Any authentication weakness in that bundled interface would compromise the credential store protecting the rest of the deployment.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cisagov

Products

Malcolm

CVE-2026-48005

Apache HTTP Server: mod_auth_digest reauthentication attack

Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck . Users are recommended to upgrade to version 2.4.69, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Apache Http Server Http Server Hummingbird

CVE-2026-103765

Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcp_data_port or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Kvcache-ai

Products

Mooncake

CVE-2026-79687

Missing Authentication in Dell PowerStore Allows Unauthorized Filesystem Access

Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Powerstore 1000t Powerstore 1200t Powerstore 3000t and 10 more

CVE-2026-104446

YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient, sender, subject and body for spam and phishing.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-78577

Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200

Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength information. Successful exploitation may disclose information about the wireless environment surrounding the camera, allowing an attacker to learn elements of the local wireless topology.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Tapo C120 V1 Tapo C200 V5

CVE-2026-104058

Podgrab Missing Authentication on WebSocket /ws Endpoint

Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnections set, capture PlayerExists broadcasts containing client-supplied player identifiers, and replay them in a RegisterPlayer message to hijack queue payloads intended for authenticated users, exposing episode IDs, titles, and server-side file paths while potentially disrupting legitimate playback.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Akhilrex

Products

Podgrab

CVE-2026-14983

Missing Authentication in Teledyne FLIR Robots running Aware2

Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endpoint.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Teledyne Flir

Products

Aware2

CVE-2026-78578

Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200

Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup.  An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful exploitation disconnects the camera from its intended wireless network, making it unreachable on its management address, resulting in a denial-of-service condition.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Tapo C120 V1 Tapo C200 V5

CVE-2026-53988

Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints

Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, when combined with write access to the tracked git branch, container escape and full host compromise via attacker-controlled docker-compose.yml with privileged bind mounts.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Finsys

Products

Dockhand

CVE-2026-11430

Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request. The primitive is triggering-existing-jobs, not attacker-chosen command execution: the attacker controls when the jobs run and which one runs (via ?job=), but does not control what the jobs do. Code execution follows only when the operator has configured a job that shells out, and even then the attacker controls timing rather than payload. Not a default-install issue: reaching the endpoint requires the separate scheduler-webhook GPM plugin to be installed, scheduler.modern.webhook.enabled to be true (default false), and no webhookToken to be configured; a stock Grav or Grav-Admin install exposes nothing here.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Getgrav Trilby Media

Products

Grav Getgrav/grav Grav Cms Scheduler-webhook Plugin

CVE-2023-54344

Eclipse Equinox OSGi 3.7.2 Remote Code Execution via Console

Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending payloads to the console interface. Attackers can connect to the OSGi console port and send base64-encoded bash commands wrapped in fork directives to achieve code execution and establish reverse shell connections.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Eclipse Equinox

Products

Equinox [osgi

CVE-2023-54342

Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution

Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to execute arbitrary code by exploiting the fork command functionality. Attackers can establish a telnet connection to the OSGi console, perform a telnet handshake, and send fork commands to download and execute malicious Java code, establishing a reverse shell connection.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Eclipse Equinox

Products

Equinox [osgi

CVE-2026-103536

ZongXR Supermarket save Endpoint OrderController.java OrderController.addOrder missing authentication

A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component save Endpoint. Such manipulation of the argument userId leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zongxr

Products

Supermarket

CVE-2026-76142

Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Genians

Products

Genian Nac Genian Ztna