Base de CVEs

CVE-2026-89176 Alta · 8.8 CWE-306 11/09/2026

Howyar｜WeenyGenius - Missing Authentication

WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network can easily spoof student or teacher endpoints. Impersonating a student can disrupt normal classroom operations, whereas impersonating a teacher can induce student computers to initiate connections, thereby gaining remote control over the student endpoints.

CVE-2026-9336 Alta · 7.5 CWE-306 10/09/2026

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space.

CVE-2026-88285 Crítica · 9.4 CWE-306 10/09/2026

GV-LPC2011/LPC2211 - Unauthenticated PTZ Control Service

GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands.

CVE-2026-67593 Crítica · 9.1 CWE-306 10/09/2026

Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVE-2026-49364 Crítica · 9.1 CWE-306 10/09/2026

Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVE-2026-49363 Alta · 7.5 CWE-306 10/09/2026

Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVE-2026-57967 Crítica · 9.8 CWE-306 10/09/2026

Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVE-2026-49362 Alta · 7.5 CWE-306 10/09/2026

Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVE-2026-77974 Alta · 8.0 CWE-306 09/09/2026

Softish C6 Ear Camera and EarVision Android Application Missing authentication for critical function

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel.

CVE-2026-79961 Média · 5.3 CWE-306 09/09/2026

Missing Authentication for Critical Function em Dell Secure Connect Gateway

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVE-2026-11838 Média · 4.3 CWE-306 09/09/2026

Improper Authorization in Yordam Informatics' Library Reservation System

Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation. This issue affects Library Reservation System: before v22.2.

CVE-2026-85981 Média · 6.7 CWE-306 08/09/2026

Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector

The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.

CVE-2026-83991 Média · 5.5 CWE-306 08/09/2026

Windows Cloud Files Mini Filter Driver Tampering Vulnerability

Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.

CVE-2026-73004 Média · 5.5 CWE-306 08/09/2026

Windows Autopilot Tampering Vulnerability

Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally.

CVE-2026-72964 Média · 5.5 CWE-306 08/09/2026

Windows Internet Connection Sharing (ICS) Tampering Vulnerability

Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally.

CVE-2026-69674 Média · 5.5 CWE-306 08/09/2026

Windows Modern Device Management (MDM) Security Feature Bypass Vulnerability

Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally.

CVE-2026-69554 Média · 5.5 CWE-306 08/09/2026

Microsoft Windows Search Component Tampering Vulnerability

Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.

CVE-2026-69528 Alta · 7.8 CWE-306 08/09/2026

Windows Shell Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally.

CVE-2026-69415 Média · 6.8 CWE-306 08/09/2026

Windows DHCP Server Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-69321 Média · 5.5 CWE-306 08/09/2026

Windows Power Dependency Coordinator Tampering Vulnerability

Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally.

CVE-2026-86728 Alta · 7.5 CWE-306 08/09/2026

AVideo through 29.0 Unauthenticated Disclosure via epg.json.php

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server identifiers, and complete programme schedules without authentication.

CVE-2026-86727 Alta · 7.5 CWE-306 08/09/2026

AVideo through 29.0 Information Disclosure via stats.json.php

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.

CVE-2026-77097 Alta · 8.2 CWE-306 08/09/2026

Private Metrics Server Denial of Service

Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

CVE-2026-62645 Crítica · 9.8 CWE-306 08/09/2026

Missing Authentication for Critical Function em Siemens Reyrolle 7SR5

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device.

CVE-2026-19397 Alta · 7.7 CWE-306 08/09/2026

Missing Authentication for Critical Function em Asus Control Center Express Agent

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent ' section on the ASUS Security Advisory for more information.