Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,325

Export CSV
CVE-2026-100672

grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin service is registered on the current route rather than that the visitor is authenticated, and it echoes the JSON and calls exit() during the plugins stage, before the classic Admin plugin would render its login screen. On a site using the classic Admin plugin with Comments enabled (the default), an unauthenticated remote attacker can request /admin/comments/page:<n> (e.g. page:0.001) and retrieve every comment from the last 7 days, including each commenter's email address and the absolute server filesystem path of the data file. Sites running the Grav 2.0 Admin Next stack (admin2 + api) are not affected via this path. The issue is fixed in 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath from the response.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav
CVE-2026-82930

Missing Authentication in mH-DEVELOPER

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to manipulate building automation devices. This issue was fixed in version 3.0.30

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
F&f Filipowski F F Filipowski
Products
Mh-developer Mh-developer
CVE-2026-59563

HMAC Confirmation Token Unbinding in zscaler-mcp-server

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Zscaler
Products
Zscaler-mcp-server
CVE-2026-101077

Netcore NR289-GE boa_temp process_request missing authentication

A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missing authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Netcore
Products
Nr289-ge
CVE-2026-52748

Missing authentication for backup functionality in Kaon AR2140X

The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthenticated remote attacker to trigger a configuration backup and retrieve it in a form encrypted by a device-specific key. Triggering this function renders the router inoperable for a substantial period of time.  This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Kaon Kaongroup
Products
Ar2140 Ar2140
CVE-2026-97866

Zhonglun CloudPOS Automatic Update Program.cs channel accessible

A weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of the file Program.cs of the component Automatic Update. Executing a manipulation of the argument version/url/packagekey/package name can lead to channel accessible by non-endpoint. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitation appears to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zhonglun
Products
Cloudpos
CVE-2026-97879

zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zhistaredu
Products
Startraining
CVE-2026-82383

Apache Roller: Anonymous setup action allows frontpage configuration tampering

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check. No optional feature or non-default configuration is required; the result can redirect or break the site's public frontpage, with administrative recovery available. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which restricts the write to global administrators.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Roller
CVE-2026-49470

GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2026-100746

coollabsio Coolify GitHub App Setup redirect missing authentication

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 4.1.1 mitigates this issue. The patch is identified as fc89e357feed5180ed1ab5eb9cb330578f025539. The affected component should be upgraded.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Coollabsio
Products
Coolify
CVE-2026-76715

Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected appliance.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Analytics And Location Engine Ale
CVE-2026-76701

Unauthenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking EdgeConnect SD-WAN Gateways.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-77248

MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while upload_attachment accepts an unrestricted file_path. An unauthenticated network caller can read files available to the MCP process, upload them to an attacker-selected Jira issue or Confluence page, and retrieve the contents. The advisory traces the vulnerable input and processing flow through streamable-http, UserTokenMiddleware, upload_attachment, file_path, and _get_fetcher, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mcp-atlassian Sooperset
Products
Mcp Atlassian Mcp-atlassian
CVE-2026-77254

MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller can perform operations with the operator account's permissions unless the deployment has an independent authentication boundary. The advisory traces the vulnerable input and processing flow through streamable-http, UserTokenMiddleware, _get_fetcher, and global credentials, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Mcp-atlassian Sooperset
Products
Mcp Atlassian Mcp-atlassian
CVE-2026-101004

notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be initiated remotely. Versions 4.1.0 - 4.9.5.2 allow unauthenticated exploitation due to missing method check. In versions 4.9.5.7 - 4.10.10 a guard present but only enforced when CACHE_REVALIDATION_TOKEN is set. Default deployments remain unprotected. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Notionnext-org
Products
Notionnext
CVE-2026-76447

Cisco Identity Services Engine Certificate Reload Vulnerability

A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder certificate and key material. This vulnerability is due to missing authentication on a function of the OCSP responder. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to cause the OCSP responder to reload certificate and key material on demand.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software
CVE-2026-76444

Cisco Identity Services Engine Information Disclosure Vulnerability

A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. This vulnerability is due to missing authentication on the Policy Runtime Repository Table (PRRT) service. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to obtain sensitive configuration information from the affected device.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software
CVE-2026-76439

Cisco Identity Services Engine Event Injection Vulnerability

A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote attacker to submit forged posture status events into the endpoint posture pipeline. This vulnerability is due to insufficient authentication on an internal interface that is exposed through the guest portal. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to manipulate the posture status on the affected system.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Identity Services Engine Identity Services Engine Passive Identity Connector Identity Services Engine Software
CVE-2026-84461

Zammad: Missing rate limiting allows password brute-forcing during two-factor login

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also revealed whether a guess was correct, even before two-factor authentication was checked. This made it possible to brute-force weak or reused passwords. This issue is fixed in version 7.1.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zammad
Products
Zammad
CVE-2026-5267

Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS

Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive information.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ciena
Products
Navigator Ncs