CVE Database

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which deactivates all installed plugins and their functionality, such as payment and shipping integrations, resulting in a shop-wide denial of service. The attack requires a single request and can be automated against many installations.

Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or management settings. Under certain usage conditions involving interaction between the user, mobile application, and device-cloud service, insufficient protection of account-related communications may also expose account information. Successful exploitation may allow an unauthenticated adjacent-network attacker to perform unauthorized device-management actions and disrupt legitimate user control. Under certain conditions, account-related information may also be exposed, potentially leading to compromise of the associated cloud account.

Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.

Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.

Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.

Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.

Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.

Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.