Base de CVEs

CVE-2026-57967 Crítica · 9.8 CWE-306 10/09/2026

Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVE-2026-49362 Alta · 7.5 CWE-306 10/09/2026

Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVE-2026-77974 Alta · 8.0 CWE-306 09/09/2026

Softish C6 Ear Camera and EarVision Android Application Missing authentication for critical function

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel.

CVE-2026-79961 Média · 5.3 CWE-306 09/09/2026

Missing Authentication for Critical Function em Dell Secure Connect Gateway

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVE-2026-11838 Média · 4.3 CWE-306 09/09/2026

Improper Authorization in Yordam Informatics' Library Reservation System

Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation. This issue affects Library Reservation System: before v22.2.

CVE-2026-85981 Média · 6.7 CWE-306 08/09/2026

Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector

The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.

CVE-2026-83991 Média · 5.5 CWE-306 08/09/2026

Windows Cloud Files Mini Filter Driver Tampering Vulnerability

Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.

CVE-2026-73004 Média · 5.5 CWE-306 08/09/2026

Windows Autopilot Tampering Vulnerability

Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally.

CVE-2026-72964 Média · 5.5 CWE-306 08/09/2026

Windows Internet Connection Sharing (ICS) Tampering Vulnerability

Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally.

CVE-2026-69674 Média · 5.5 CWE-306 08/09/2026

Windows Modern Device Management (MDM) Security Feature Bypass Vulnerability

Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally.

CVE-2026-69554 Média · 5.5 CWE-306 08/09/2026

Microsoft Windows Search Component Tampering Vulnerability

Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.

CVE-2026-69528 Alta · 7.8 CWE-306 08/09/2026

Windows Shell Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally.

CVE-2026-69415 Média · 6.8 CWE-306 08/09/2026

Windows DHCP Server Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-69321 Média · 5.5 CWE-306 08/09/2026

Windows Power Dependency Coordinator Tampering Vulnerability

Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally.

CVE-2026-86728 Alta · 7.5 CWE-306 08/09/2026

AVideo through 29.0 Unauthenticated Disclosure via epg.json.php

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server identifiers, and complete programme schedules without authentication.

CVE-2026-86727 Alta · 7.5 CWE-306 08/09/2026

AVideo through 29.0 Information Disclosure via stats.json.php

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.

CVE-2026-77097 Alta · 8.2 CWE-306 08/09/2026

Private Metrics Server Denial of Service

Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

CVE-2026-62645 Crítica · 9.8 CWE-306 08/09/2026

Missing Authentication for Critical Function em Siemens Reyrolle 7SR5

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device.

CVE-2026-19397 Alta · 7.7 CWE-306 08/09/2026

Missing Authentication for Critical Function em Asus Control Center Express Agent

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent ' section on the ASUS Security Advisory for more information.

CVE-2026-86543 Crítica · 9.8 CWE-306 07/09/2026

knowns before 0.30.0 Unauthenticated Management API Exposure

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.

CVE-2026-86506 Média · 5.9 CWE-306 07/09/2026

Missing Authentication for Critical Function em Jetbrains Goland

In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data

CVE-2026-86502 Alta · 8.4 CWE-306 07/09/2026

Missing Authentication for Critical Function em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

CVE-2026-86486 Baixa · 3.7 CWE-306 07/09/2026

Missing Authentication for Critical Function em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank

CVE-2026-86480 Crítica · 9.8 CWE-306 07/09/2026

Missing Authentication for Critical Function em Jetbrains Hub

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

CVE-2026-79645 Alta · 8.2 CWE-306 07/09/2026

Missing Authentication for Critical Function em Dell Secure Connect Gateway

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.