Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,325

Export CSV
CVE-2026-72536

Chaskiq Chaskiq - Missing Authentication

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Chaskiq
Products
Chaskiq
CVE-2024-49604

WordPress Simple User Registration plugin <= 6.7 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Media Simple User Registration wp-registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through <= 6.7.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Najeeb Ahmad Najeebmedia
Products
Simple User Registration Memberhero
CVE-2026-66411

Unauthenticated WebSocket Control of Ecovacs Deebot Robots

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-72688

OpenSignLabs opensignserver - Missing Authentication for Critical Function

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Opensignlabs
Products
Opensignserver
CVE-2026-72577

NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Nasa
Products
Fprime
CVE-2026-72748

AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php

AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.

CVSS 4.0 · 6.9 Medium EPSS 1.2% KEV · Not listed
Vendors
Wwbn
Products
Avideo
CVE-2026-31983

Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0

A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the uploaded public SSH keys.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nozomi Networks Nozominetworks
Products
Cmc Guardian Cmc and 1 more
CVE-2026-0283

PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)

An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access to bypass security restrictions and establish an unauthorized site-to-site VPN connection. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

CVSS 4.0 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Palo Alto Networks Paloaltonetworks
Products
Cloud Ngfw Pan-os Prisma Access and 1 more
CVE-2026-72871

Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts gh_init organizationId and userId values from the state parameter and calls createGithub in packages/server/src/services/github.ts, allowing an attacker to insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into another organization. This issue is fixed in version 0.29.13.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-46409

OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server-side Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage a user visits while OpenYak is running can issue cross-origin requests to this local server — the browser acts as a proxy into loopback, bypassing OS-level network isolation. Chained, this lets a malicious page execute arbitrary shell commands on the host (RCE) via the build agent with `permission_presets.bash=true`, shut down the service, and exfiltrate chat history and account PII — with no user interaction beyond opening the page. Version 1.1.3 patches the issue.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Openyak
Products
Openyak
CVE-2026-15416

Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.

CVSS 3.1 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Data Foundation Openshift Gitops
CVE-2025-71409

No Authentication for Very High Frequency Data Link messages used in CPDLC

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Atn-b1
Products
Cpdlc
CVE-2026-72593

dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Dulldusk
Products
Phpfm
CVE-2026-72586

frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Frangoteam
Products
Fuxa
CVE-2026-61808

LightRAG: Missing Authentication for Critical API Functions in Default Configuration

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Hkuds
Products
Lightrag
CVE-2026-71289

NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API

The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. ":8089/tcp") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Nasa-ammos
Products
Anms
CVE-2026-71262

IoTSharp BlobStorageController Missing Authentication and Path Traversal

IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Iotsharp
Products
Iotsharp
CVE-2026-71241

Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History

Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Lyric777
Products
Book-management-system
CVE-2026-71214

NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server

The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Nasa-ammos
Products
Plandev (sequencing-server)