Base de CVEs

CVE-2026-40184 Média · 5.3 CWE-306 10/04/2026

Unauthenticated Access to Uploaded Files in TREK

TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2.

CVE-2026-5777 Alta · 8.7 CWE-306 10/04/2026

Security Misconfiguration Vulnerability in Atom 3x Projector

This vulnerability exists in the Atom 3x Projector due to improper exposure of the Android Debug Bridge (ADB) service over the local network without authentication or access controls. An unauthenticated attacker on the same network can exploit this vulnerability to obtain root-level access, leading to complete compromise of the targeted device.

CVE-2026-33788 Alta · 7.8 CWE-306 09/04/2026

Junos OS Evolved: Local, authenticated attacker can gain privileged access to FPCs

A Missing Authentication for Critical Function vulnerability in the Flexible PIC Concentrators (FPCs) of Juniper Networks Junos OS Evolved on PTX Series allows a local, authenticated attacker with low privileges to gain direct access to FPCs installed in the device. A local user with low privileges can gain direct access to the installed FPCs as a high privileged user, which can potentially lead to a full compromise of the affected component. This issue affects Junos OS Evolved on PTX10004, PTX10008, PTX100016, with JNP10K-LC1201 or JNP10K-LC1202: * All versions before 21.2R3-S8-EVO, * 21.4-EVO versions before 21.4R3-S7-EVO, * 22.2-EVO versions before 22.2R3-S4-EVO, * 22.3-EVO versions before 22.3R3-S3-EVO, * 22.4-EVO versions before 22.4R3-S2-EVO, * 23.2-EVO versions before 23.2R2-EVO.

CVE-2026-4436 Alta · 8.6 CWE-306 09/04/2026

GPL Odorizers GPL750 Missing Authentication for Critical Function

A low-privileged remote attacker can send Modbus packets to manipulate register values that are inputs to the odorant injection logic such that too much or too little odorant is injected into a gas line.

CVE-2026-39987 Crítica · 9.8 KEV Urgente · 81 Exploit público CWE-306 09/04/2026

Execução remota de código pré-autenticação no Marimo via WebSocket de terminal sem autenticação

marimo é um notebook Python reativo. Antes da versão 0.23.0, o Marimo apresenta uma vulnerabilidade de RCE pré-autenticação. O endpoint de WebSocket de terminal /terminal/ws não valida autenticação, permitindo que um atacante não autenticado obtenha um shell PTY completo e execute comandos arbitrários no sistema. Diferentemente de outros endpoints WebSocket (por exemplo, /ws) que chamam corretamente validate_auth() para autenticação, o endpoint /terminal/ws verifica apenas o modo de execução e o suporte da plataforma antes de aceitar conexões, ignorando completamente a verificação de autenticação. Esta vulnerabilidade é corrigida na versão 0.23.0.

CVE-2025-30650 Média · 6.7 CWE-306 08/04/2026

Junos OS: Privileged local user can gain access to a Linux-based FPC as root

A Missing Authentication for Critical Function vulnerability in command processing of Juniper Networks Junos OS allows a privileged local attacker to gain access to Linux-based line cards as root. This issue affects systems running Junos OS using Linux-based line cards. Affected line cards include: * MPC7, MPC8, MPC9, MPC10, MPC11 * LC2101, LC2103 * LC480, LC4800, LC9600 * MX304 (built-in FPC) * MX-SPC3 * SRX5K-SPC3 * EX9200-40XS * FPC3-PTX-U2, FPC3-PTX-U3 * FPC3-SFF-PTX * LC1101, LC1102, LC1104, LC1105 This issue affects Junos OS: * all versions before 22.4R3-S8, * from 23.2 before 23.2R2-S6, * from 23.4 before 23.4R2-S6, * from 24.2 before 24.2R2-S3, * from 24.4 before 24.4R2, * from 25.2 before 25.2R2.

CVE-2026-39393 Alta · 8.1 CWE-306 08/04/2026

Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check (cache('settings')) combined with .env file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the .env file with attacker-controlled database credentials, achieving full application takeover. This vulnerability is fixed in 0.31.4.0.

CVE-2026-5300 Crítica · 9.1 CWE-306 08/04/2026

CoolerControl coolercontrold: falta de autenticação em função crítica

Funcionalidade não autenticada em CoolerControl/coolercontrold <4.0.0 permite que atacantes não autenticados visualizem e modifiquem dados potencialmente sensíveis por meio de requisições HTTP

CVE-2026-35584 Média · 6.5 CWE-306 07/04/2026

FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the given conversation_id. This allows any unauthenticated attacker to mark any thread as read by passing arbitrary IDs, enumerate valid thread IDs via HTTP response codes (200 vs 404), and manipulate opened_at timestamps across conversations (IDOR). This vulnerability is fixed in 1.8.212.

CVE-2026-35523 Alta · 7.5 CWE-306 07/04/2026

Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol

Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connection_init handshake has been completed before processing start (subscription) messages. This allows a remote attacker to skip the on_ws_connect authentication hook entirely by connecting with the graphql-ws subprotocol and sending a start message directly, without ever sending connection_init. This vulnerability is fixed in 0.312.3.

CVE-2026-22679 Crítica · 9.8 CWE-306 07/04/2026

Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint

Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).

CVE-2026-1900 Média · 6.5 CWE-306 07/04/2026

Link Whisper Free < 0.9.1 - Unauthenticated Settings and User Meta Update

The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates.

CVE-2026-35450 Média · 5.3 CWE-306 06/04/2026

WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().

CVE-2026-4272 Alta · 8.1 CWE-306 05/04/2026

CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability

Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA. This vulnerability could allow a remote attacker within Bluetooth range of the scanner's base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272 and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.

CVE-2019-25686 Alta · 7.5 CWE-306 05/04/2026

Core FTP 2.0 build 653 PBSZ Unauthenticated Denial of Service

Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a malformed command with an oversized buffer. Attackers can send a PBSZ command with a payload exceeding 211 bytes to trigger an access violation and crash the FTP server process.

CVE-2018-25246 Alta · 7.5 CWE-306 04/04/2026

Wikipedia 12.0 Denial of Service via Search

Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of repeated characters into the search bar to trigger an application crash.

CVE-2018-25241 Alta · 7.5 CWE-306 04/04/2026

VPN Browser+ 1.1.0.0 Denial of Service

VPN Browser+ 1.1.0.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of characters into the search bar to trigger an unhandled exception that terminates the application.

CVE-2026-34952 Crítica · 9.1 CWE-306 03/04/2026

PraisonAI: Missing Authentication in WebSocket Gateway

PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issue has been patched in version 4.5.97.

CVE-2026-32646 Alta · 7.5 CWE-306 03/04/2026

Gardyn Cloud API Missing Authentication for Critical Function

A specific administrative endpoint is accessible without proper authentication, exposing device management functions.

CVE-2026-28767 Média · 5.3 CWE-306 03/04/2026

Gardyn Cloud API Missing Authentication for Critical Function

A specific administrative endpoint notifications is accessible without proper authentication.

CVE-2026-28766 Alta · 7.5 CWE-306 03/04/2026

Gardyn Cloud API Missing Authentication for Critical Function

A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

CVE-2026-0545 Crítica · 9.8 Exploit público CWE-306 03/04/2026

mlflow/mlflow - Falta de autenticação para função crítica na API de jobs

No mlflow/mlflow, os endpoints de jobs baseados em FastAPI em /ajax-api/3.0/jobs/* não são protegidos por autenticação ou autorização quando o app basic-auth está habilitado. Esta vulnerabilidade afeta a versão mais recente do repositório. Se a execução de jobs estiver habilitada (MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true) e qualquer função de job estiver na lista de permitidas, qualquer cliente de rede pode enviar, ler, pesquisar e cancelar jobs sem credenciais, contornando totalmente o basic-auth. Isso pode levar à execução remota de código não autenticada se os jobs permitidos realizarem ações privilegiadas, como execução de shell ou alterações no sistema de arquivos. Mesmo que os jobs sejam considerados seguros, isso ainda constitui um bypass de autenticação, podendo resultar em spam de jobs, negação de serviço (DoS) ou exposição de dados nos resultados dos jobs.

CVE-2026-32211 Alta · 7.5 CWE-306 02/04/2026

Azure MCP Server Information Disclosure Vulnerability

Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.

CVE-2025-15620 Alta · 8.6 CWE-306 02/04/2026

HiOS Switch Platform Denial-of-Service via Web Interface

HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.

CVE-2026-35053 Crítica · 9.8 CWE-306 02/04/2026

OneUptime: Unauthenticated Workflow Execution via ManualAPI

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints (GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId) without any authentication middleware. An attacker who can obtain or guess a workflow ID can trigger arbitrary workflow execution with attacker-controlled input data, enabling JavaScript code execution, notification abuse, and data manipulation. This issue has been patched in version 10.0.42.