Total
2823 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-8505 | 4 Apple, Langflow, Linux and 1 more | 4 Macos, Langflow, Linux Kernel and 1 more | 2026-07-23 | N/A | 9.8 CRITICAL |
| IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE). | |||||
| CVE-2026-50333 | 1 Microsoft | 11 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 8 more | 2026-07-23 | N/A | 7.8 HIGH |
| Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-63429 | 2026-07-22 | N/A | 8.6 HIGH | ||
| HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoint is used by both authenticated form creators and unauthenticated form submitters; because no form-context binding exists, every request to it is anonymously accepted. Version 3.0.0-rc.9 contains a patch for the issue. | |||||
| CVE-2026-50759 | 2026-07-22 | N/A | 7.5 HIGH | ||
| An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} endpoints with no authentication. | |||||
| CVE-2026-50225 | 1 Acer | 2 Connect M6e 5g, Connect M6e 5g Firmware | 2026-07-22 | N/A | 9.1 CRITICAL |
| The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database. | |||||
| CVE-2026-25550 | 2026-07-22 | N/A | 9.8 CRITICAL | ||
| Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016 <= R9, and DataServiceSingleton for BarTender 2019 <= R10 — configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. An unauthenticated remote attacker can exploit .NET Remoting object unmarshalling to read or write arbitrary files on the server using the .NET WebClient class, or coerce NTLMv2 authentication by supplying a UNC path to an attacker-controlled server, enabling sensitive credential disclosure, remote code execution, or lateral movement depending on service account privileges and network environment. The service runs in the context of NT AUTHORITY\SYSTEM. | |||||
| CVE-2019-25738 | 2026-07-22 | N/A | 9.8 CRITICAL | ||
| WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover. | |||||
| CVE-2024-27892 | 2026-07-22 | N/A | 9.6 CRITICAL | ||
| Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch. | |||||
| CVE-2024-27890 | 2026-07-22 | N/A | 9.6 CRITICAL | ||
| Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch. | |||||
| CVE-2026-0611 | 2026-07-22 | N/A | 9.8 CRITICAL | ||
| Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerability through a deprecated .NET Remoting HTTP channel exposed on port 8989 that allows attackers to perform arbitrary file read and write operations by supplying valid .NET URI endpoints. Attackers can write ASPX webshells to the IIS wwwroot directory to achieve unauthenticated remote code execution on the system. Port 8989 is not exposed in a default Sentinel installation; exploitation requires that the .NET Remoting port has been explicitly made network-accessible through deliberate configuration or network policy changes. | |||||
| CVE-2026-42074 | 1 Gitlawb | 1 Openclaude | 2026-07-22 | N/A | 9.8 CRITICAL |
| OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM (an untrusted principal per the project's own threat model) can set it to true in any tool_use response. Combined with the default allowUnsandboxedCommands: true setting, a prompt-injected model can escape the sandbox for any arbitrary command, achieving full host-level code execution. This issue has been patched in version 0.5.1. | |||||
| CVE-2026-10617 | 2026-07-22 | 7.5 HIGH | 7.3 HIGH | ||
| A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug. | |||||
| CVE-2026-36603 | 2026-07-22 | N/A | 8.1 HIGH | ||
| Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default through the admin interface, allowing any unauthenticated LAN device to create arbitrary port forwarding rules and access WAN traffic statistics. | |||||
| CVE-2026-24088 | 1 Qualcomm | 492 Ar9380, Ar9380 Firmware, Csr8811 and 489 more | 2026-07-22 | N/A | 8.2 HIGH |
| Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader. | |||||
| CVE-2026-24090 | 1 Qualcomm | 434 Ar8031, Ar8031 Firmware, Ar8035 and 431 more | 2026-07-22 | N/A | 7.1 HIGH |
| Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow. | |||||
| CVE-2026-57969 | 1 Microsoft | 1 Azure Cyclecloud | 2026-07-22 | N/A | 8.8 HIGH |
| Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-50451 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-07-22 | N/A | 7.1 HIGH |
| Missing authentication for critical function in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-49174 | 1 Microsoft | 9 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 6 more | 2026-07-22 | N/A | 6.1 MEDIUM |
| Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally. | |||||
| CVE-2026-63757 | 1 Surrealdb | 1 Surrealdb | 2026-07-22 | N/A | 8.8 HIGH |
| SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges. | |||||
| CVE-2026-47396 | 2026-07-22 | N/A | 9.8 CRITICAL | ||
| PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue. | |||||