Base de CVEs

CVE-2026-22924 Crítica · 9.1 CWE-306 12/05/2026

Siemens SIMATIC CN 4100 Falta de Autenticação (CWE-306)

Foi identificada uma vulnerabilidade no SIMATIC CN 4100 da Siemens (todas as versões < V5.0). A aplicação afetada não restringe adequadamente conexões não autenticadas e é suscetível a condições de esgotamento de recursos. Isso pode permitir que um atacante interrompa operações normais ou execute ações não autorizadas, potencialmente impactando a disponibilidade e a integridade do sistema.

CVE-2026-43881 Média · 5.3 CWE-306 11/05/2026

WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing Guard

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/users.json.php exposes two unauthenticated paths that disclose the full set of registered user accounts. The isCompany request parameter causes the handler to set $ignoreAdmin = true for any non-admin caller (including unauthenticated visitors), which defeats the admin-only guard inside User::getAllUsers()/User::getTotalUsers(). A second path accepts users_id and calls User::getUserFromID() directly with no permission check, producing a single-user oracle. Both paths return id, identification (display name), channel URL, photo, background, and status, plus the total account count. Commit d9cdc702481a626b15f814f6093f1e2a9c20d375 contains an updated fix.

CVE-2026-42864 Crítica · 9.9 CWE-306 11/05/2026

FireFighter: falta de autenticação no endpoint do bot Jira (CWE-306)

FireFighter é uma aplicação de gestão de incidentes. Antes da versão 0.0.54, o endpoint POST /api/v2/firefighter/raid/jira_bot (CreateJiraBotView) é acessível sem autenticação (permission_classes = [permissions.AllowAny]). Seu payload de attachments é buscado no lado do servidor via httpx.get() sem qualquer validação de URL e, em seguida, enviado como anexo no ticket Jira que é criado. Um chamador não autenticado capaz de alcançar o ingress pode forçar o pod a buscar URLs arbitrárias e exfiltrar a resposta como anexo do Jira. Em implantações EC2/EKS que não exigem IMDSv2, isso permite o roubo das credenciais temporárias da AWS associadas ao papel IAM do pod. A docstring da view afirma que um token Bearer é obrigatório, mas o código não o exige. Esta vulnerabilidade foi corrigida na versão 0.0.54.

CVE-2026-44413 Alta · 7.5 CWE-306 11/05/2026

In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to...

In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access

CVE-2026-42856 Alta · 8.7 CWE-306 11/05/2026

Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools. This vulnerability is fixed in 5.1.3.

CVE-2021-47940 Crítica · 9.8 CWE-306 10/05/2026

Plugin Download From Files para WordPress: upload arbitrário de arquivos sem autenticação

O plugin Download From Files para WordPress na versão 1.48 e anteriores contém uma vulnerabilidade de upload arbitrário de arquivos que permite a atacantes não autenticados enviar arquivos maliciosos explorando a ação AJAX fileupload. Atacantes podem enviar requisições POST ao endpoint admin-ajax.php com a ação download_from_files_617_fileupload, manipulando o parâmetro allowExt para contornar restrições de tipo de arquivo e enviar arquivos executáveis, como shells PHP, para a raiz web.

CVE-2021-47933 Crítica · 9.8 CWE-306 10/05/2026

MStore API para WordPress - upload arbitrário de arquivos sem autenticação

O WordPress MStore API 2.0.6 contém uma vulnerabilidade de upload arbitrário de arquivos que permite que atacantes não autenticados enviem arquivos maliciosos por meio de requisições POST ao endpoint da REST API. Atacantes podem enviar arquivos PHP com nomes arbitrários para o endpoint config_file para obter execução remota de código no servidor.

CVE-2021-47936 Crítica · 9.8 CWE-306 10/05/2026

OpenCATS 0.9.4 Remote Code Execution via Resume Upload

OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Attackers can upload PHP payloads through the careers job application endpoint and execute system commands via POST requests to the uploaded file in the upload directory.

CVE-2026-42302 Crítica · 9.8 CWE-306 08/05/2026

FastGPT: execução remota de código não autenticada por configuração incorreta do code-server no agent-sandbox

O FastGPT é uma plataforma para construção de agentes de IA. Desde a versão 4.14.10 até antes da versão 4.14.13, o componente agent-sandbox do FastGPT é vulnerável a execução remota de código (RCE) não autenticada. O script de inicialização entrypoint.sh inicia o code-server com a flag --auth none e vincula o serviço a todas as interfaces de rede (0.0.0.0:8080). Essa configuração permite que qualquer usuário com acesso de rede à porta contorne a autenticação e obtenha controle total sobre o ambiente do sandbox. Este problema foi corrigido na versão 4.14.13.

CVE-2026-42176 Média · 6.7 CWE-306 08/05/2026

Scoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation)

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.67.0, Scoold allows the admins configuration value to be modified through /api/config/set/admins with a forged Bearer token that is accepted as an admin API token. Once that setting is changed, the target email address is written to the application configuration file. The change does not become active immediately in the current process, because the ADMINS set is loaded once at startup. After a Scoold restart, though, the selected user is recognized as an administrator and gains access to the admin panel. This issue gives an attacker a reliable persistence path: write their own email into scoold.admins, wait for a restart or trigger one operationally, and the account comes back as admin. This issue has been patched in version 1.67.0.

CVE-2026-44338 Alta · 7.3 Exploit público CWE-306 08/05/2026

PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.

CVE-2026-6736 Média · 6.5 CWE-306 07/05/2026

Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider

An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication restriction, allowing account creation and session establishment without identity provider validation. The created account was limited to the default base permissions configured on the instance. Exploitation required network access to a GHES instance configured with an external authentication provider. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.

CVE-2026-7415 Crítica · 9.8 CWE-306 07/05/2026

Open MQTT orchestration without read/write ACLs in Yarbo robot firmware

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind.

CVE-2026-41930 Crítica · 9.8 CWE-306 06/05/2026

Vvveb: credenciais fixas do phpMyAdmin expõem o banco de dados

O Vvveb anterior à versão 1.0.8.2 contém uma vulnerabilidade de credenciais fixas (hard-coded) em sua configuração docker-compose-apache.yaml, que permite a atacantes não autenticados acessar o contêiner do phpMyAdmin incluído com credenciais de banco de dados pré-configuradas. Atacantes podem conectar-se à porta do phpMyAdmin para obter acesso irrestrito de leitura e escrita a todo o banco de dados do Vvveb, incluindo hashes de senhas de administradores, informações pessoais identificáveis de clientes e dados de pedidos, possibilitando a tomada de contas e a manipulação de dados.

CVE-2023-54344 Crítica · 9.8 CWE-306 05/05/2026

Eclipse Equinox OSGi 3.7.2 Remote Code Execution via Console

Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending payloads to the console interface. Attackers can connect to the OSGi console port and send base64-encoded bash commands wrapped in fork directives to achieve code execution and establish reverse shell connections.

CVE-2023-54342 Crítica · 9.8 CWE-306 05/05/2026

Execução remota de código sem autenticação no console do Eclipse Equinox OSGi (CVE-2023-54342)

Versões do Eclipse Equinox OSGi 3.8 até 3.18 contêm uma vulnerabilidade de execução remota de código na interface de console que permite a atacantes não autenticados executar código arbitrário explorando a funcionalidade do comando fork. Atacantes podem estabelecer uma conexão telnet com o console OSGi, realizar um handshake telnet e enviar comandos fork para baixar e executar código Java malicioso, estabelecendo uma conexão de shell reverso.

CVE-2026-42221 Crítica · 9.8 Exploit público CWE-306 04/05/2026

nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacker who reaches the service before the legitimate operator can set the admin email, username, and password, causing permanent initial-instance takeover. This issue has been patched in version 2.3.8.

CVE-2026-42796 Crítica · 9.8 Exploit público CWE-306 04/05/2026

Arelle < 2.39.10 Unauthenticated RCE via /rest/configure

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.

CVE-2026-35514 Média · 6.5 CWE-306 30/04/2026

Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, the endpoint POST /user/invited does not validate any invite token, authentication header, or session. Any unauthenticated attacker can call this endpoint directly to create a fully active account and receive a valid JWT — even when the instance has existing users and signupRestricted is enabled. This bypass is distinct from the normal registration endpoint (POST /user) which enforces signupRestricted and sets active: false pending verification. This issue has been patched in version 5.0.0.

CVE-2025-13030 Crítica · 9.8 CWE-306 30/04/2026

django-mdeditor is Missing Authentication for Critical Function

All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.

CVE-2026-0204 Alta · 8.0 CWE-306 29/04/2026

A vulnerability in the access control mechanism of SonicOS may allow certain management interface...

A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.

CVE-2026-41940 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-306 29/04/2026

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

CVE-2026-3893 Crítica · 9.4 CWE-306 28/04/2026

Receptor GNSS Carlson VASCO-B: falta de autenticação (CVE-2026-3893)

O Carlson VASCO-B GNSS Receiver não possui mecanismo de autenticação, permitindo que um atacante com acesso à rede acesse diretamente e modifique suas configurações e funções operacionais, sem precisar de credenciais.

CVE-2026-5944 Alta · 8.2 CWE-306 28/04/2026

Cisco Intersight Device Connector for Nutanix Prism Central Unauthenticated API Access

An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endpoint on TCP port 7373 that is accessible within the network scope of the deployment environment without authentication. An unauthenticated attacker with network access can exploit this vulnerability by sending crafted requests to the exposed endpoint to enumerate cluster metadata, including virtual machine information and cluster configuration details. While the API primarily supports read-only operations, it also allows certain cluster maintenance workflows to be invoked. Although this vulnerability does not allow persistent modification of system configurations or access to credentials or sensitive user data, successful exploitation may result in disruption of active workloads, leading to loss of service availability within the affected environment.

CVE-2026-3323 Alta · 7.5 CWE-306 28/04/2026

VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices

An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.