CVE-2026-9103

Unauthenticated Superuser Token Issuance via Auto-Login Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTO_LOGIN configuration is enabled (enabled by default), which may allow an unauthenticated network attacker to obtain full administrative access. Additionally, permissive cross-origin resource sharing (CORS) settings may allow tokens to be exposed to unintended origins, increasing the risk of unauthorized access.

CVSS 3.1 · 9.8 Critical EPSS 3.2% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-16209

Gerapy Project Upload Endpoint views.py missing authentication

A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is bd4891c60315f17611a3b7a651ffe0fba7cfe71e. Applying a patch is advised to resolve this issue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gerapy

Products

Gerapy

CVE-2026-53512

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Better-auth

Products

Better Auth

CVE-2026-9202

Unauthenticated User Registration Could Lead to Remote Code Execution

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need for AUTO_LOGIN.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-16015

poco-ai poco-claw executor_manager API tasks.py create_task missing authentication

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/tasks.py of the component executor_manager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.7 is able to resolve this issue. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. It is recommended to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Poco-ai

Products

Poco-claw

CVE-2026-44596

Yamcs: No Rate Limiting on Authentication Endpoint

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed

Vendors

Spaceapplications Yamcs

Products

Yamcs Yamcs

CVE-2026-62220

OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availability.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Openclaw

CVE-2026-46339

9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.

CVSS 3.1 · 10 Critical EPSS 2.8% KEV · Not listed

Vendors

Decolua

Products

9router

CVE-2024-8751

CVE-2024-8751

A vulnerability allows a remote unauthenticated attacker to modify the prod uct’s IP address over the Sopas ET interface. This can lead to a Denial of Service attack.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Sick

Products

Msc800 Firmware

CVE-2026-37106

DokuWiki: DokuWiki: Unauthorized account creation via registration function

An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature). The supplier also notes that there is no configuration migration scenario that would result in the self-registration being enabled without the administrators knowledge.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Dokuwiki

Products

Dokuwiki

CVE-2026-57969

Azure CycleCloud Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Cyclecloud

CVE-2014-125126

Simple E-Document Arbitrary File Upload RCE

An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header (access=3) with HTTP requests. The application’s upload mechanism fails to restrict file types and does not validate or sanitize user-supplied input, allowing attackers to upload malicious .php scripts. Authentication can be bypassed entirely by supplying a specially crafted cookie (access=3), granting access to the upload functionality without valid credentials. If file uploads are enabled on the server, the attacker can upload a web shell and gain remote code execution with the privileges of the web server user, potentially leading to full system compromise.

CVSS 4.0 · 9.2 Critical EPSS 2.0% KEV · Not listed

Vendors

Tecorange

Products

Simple E-document

CVE-2026-3047

Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Build Of Keycloak 26.2 Red Hat Build Of Keycloak 26.2.14 Red Hat Build Of Keycloak 26.4 and 4 more

CVE-2025-34104

Piwik Authenticated RCE via Custom Plugin Upload

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.

CVSS 4.0 · 9.4 Critical EPSS 1.9% KEV · Not listed

Vendors

Matomo Oracle Piwik

Products

Matomo Web Analytics Piwik

CVE-2025-15620

HiOS Switch Platform Denial-of-Service via Web Interface

HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Belden

Products

Hios Switch Hirschmann Hios Hirschmann Hios Switch Platform

CVE-2026-61458

PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint

PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Apnotic Pglombardo

Products

Password Pusher Password Pusher

CVE-2026-58123

Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.

CVSS 4.0 · 9.3 Critical EPSS 4.6% KEV · Not listed

Vendors

Get-hermes Nesquena

Products

Hermes Web Ui Hermes-webui

CVE-2026-56262

Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructive operations. Remote attackers can invoke the /monitor/actions/cleanup endpoint and manipulate monitoring state without authentication, causing service disruption.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Crawl4ai Kidocode

Products

Crawl4ai Crawl4ai

CVE-2026-55196

Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Get-hermes Hermes-webui

Products

Hermes Web Ui Hermes-webui

CVE-2026-49973

Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings

Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to the settings API endpoint without any network origin restriction. Attackers on any reachable network can send a POST request to the settings endpoint during the first-run setup window to persist an arbitrary password hash, obtain a valid session cookie, and lock out the legitimate operator from their own instance.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Get-hermes Nesquena

Products

Hermes Web Ui Hermes-webui