CVE Database

CVE-2026-79961 Medium · 5.3 CWE-306 Sep 9, 2026

Missing Authentication for Critical Function in Dell Secure Connect Gateway

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVE-2026-11838 Medium · 4.3 CWE-306 Sep 9, 2026

Improper Authorization in Yordam Informatics' Library Reservation System

Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation. This issue affects Library Reservation System: before v22.2.

CVE-2026-85981 Medium · 6.7 CWE-306 Sep 8, 2026

Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector

The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.

CVE-2026-83991 Medium · 5.5 CWE-306 Sep 8, 2026

Windows Cloud Files Mini Filter Driver Tampering Vulnerability

Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.

CVE-2026-73004 Medium · 5.5 CWE-306 Sep 8, 2026

Windows Autopilot Tampering Vulnerability

Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally.

CVE-2026-72964 Medium · 5.5 CWE-306 Sep 8, 2026

Windows Internet Connection Sharing (ICS) Tampering Vulnerability

Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally.

CVE-2026-69674 Medium · 5.5 CWE-306 Sep 8, 2026

Windows Modern Device Management (MDM) Security Feature Bypass Vulnerability

Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally.

CVE-2026-69554 Medium · 5.5 CWE-306 Sep 8, 2026

Microsoft Windows Search Component Tampering Vulnerability

Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.

CVE-2026-69528 High · 7.8 CWE-306 Sep 8, 2026

Windows Shell Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally.

CVE-2026-69415 Medium · 6.8 CWE-306 Sep 8, 2026

Windows DHCP Server Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-69321 Medium · 5.5 CWE-306 Sep 8, 2026

Windows Power Dependency Coordinator Tampering Vulnerability

Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally.

CVE-2026-86728 High · 7.5 CWE-306 Sep 8, 2026

AVideo through 29.0 Unauthenticated Disclosure via epg.json.php

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server identifiers, and complete programme schedules without authentication.

CVE-2026-86727 High · 7.5 CWE-306 Sep 8, 2026

AVideo through 29.0 Information Disclosure via stats.json.php

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.

CVE-2026-77097 High · 8.2 CWE-306 Sep 8, 2026

Private Metrics Server Denial of Service

Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

CVE-2026-62645 Critical · 9.8 CWE-306 Sep 8, 2026

Missing Authentication for Critical Function in Siemens Reyrolle 7SR5

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device.

CVE-2026-19397 High · 7.7 CWE-306 Sep 8, 2026

Missing Authentication for Critical Function in Asus Control Center Express Agent

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent ' section on the ASUS Security Advisory for more information.

CVE-2026-86543 Critical · 9.8 CWE-306 Sep 7, 2026

knowns before 0.30.0 Unauthenticated Management API Exposure

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.

CVE-2026-86506 Medium · 5.9 CWE-306 Sep 7, 2026

Missing Authentication for Critical Function in Jetbrains Goland

In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data

CVE-2026-86502 High · 8.4 CWE-306 Sep 7, 2026

Missing Authentication for Critical Function in Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

CVE-2026-86486 Low · 3.7 CWE-306 Sep 7, 2026

Missing Authentication for Critical Function in Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank

CVE-2026-86480 Critical · 9.8 CWE-306 Sep 7, 2026

Missing Authentication for Critical Function in Jetbrains Hub

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

CVE-2026-79645 High · 8.2 CWE-306 Sep 7, 2026

Missing Authentication for Critical Function in Dell Secure Connect Gateway

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVE-2026-78480 High · 7.5 CWE-306 Sep 7, 2026

Missing Authentication for Critical Function in Dell Secure Connect Gateway

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVE-2026-80132 High · 8.1 CWE-306 Sep 7, 2026

Missing Authentication for Critical Function in Dell Secure Connect Gateway

ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVE-2026-76578 Critical · 9.8 CWE-306 Sep 7, 2026

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.