Total
2856 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-21767 | 1 Hcltech | 1 Bigfix Platform | 2026-06-17 | N/A | 4.0 MEDIUM |
| HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the application without proper authentication. | |||||
| CVE-2026-21446 | 1 Webkul | 1 Bagisto | 2026-06-17 | N/A | 9.8 CRITICAL |
| Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue. | |||||
| CVE-2026-21445 | 1 Langflow | 1 Langflow | 2026-06-17 | N/A | 9.1 CRITICAL |
| Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch. | |||||
| CVE-2026-20995 | 1 Samsung | 1 Smart Switch | 2026-06-17 | N/A | 5.3 MEDIUM |
| Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration. | |||||
| CVE-2026-20781 | 1 Cloudcharge | 1 Cloudcharge.se | 2026-06-17 | N/A | 9.4 CRITICAL |
| WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. | |||||
| CVE-2026-1920 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to install addon plugins. | |||||
| CVE-2026-1919 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data. | |||||
| CVE-2026-1900 | 1 Linkwhisper | 1 Link Whisper | 2026-06-17 | N/A | 6.5 MEDIUM |
| The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates. | |||||
| CVE-2026-1775 | 2026-06-17 | N/A | N/A | ||
| The Labkotec LID-3300IP has an existing vulnerability in the ice detector software that enables an unauthenticated attacker to alter device parameters and run operational commands when specially crafted packets are sent to the device. | |||||
| CVE-2026-1729 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the 'sb_login_user_with_otp_fun' function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators. | |||||
| CVE-2026-1724 | 1 Gitlab | 1 Gitlab | 2026-06-17 | N/A | 6.8 MEDIUM |
| GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access control. | |||||
| CVE-2026-1670 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address. | |||||
| CVE-2026-1633 | 2026-06-17 | N/A | 10.0 CRITICAL | ||
| The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, allowing unauthenticated users to modify critical device settings or factory reset the device. | |||||
| CVE-2026-1632 | 2026-06-17 | N/A | 9.1 CRITICAL | ||
| MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication, which could allow an unauthenticated attacker to modify configuration settings, acquire device data or remotely reset the device. | |||||
| CVE-2026-1603 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 8.6 HIGH |
| An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data. | |||||
| CVE-2026-1453 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vulnerability can grant the attacker full administrative control over the product. | |||||
| CVE-2026-1410 | 1 Beetel | 2 777vr1, 777vr1 Firmware | 2026-06-17 | 6.2 MEDIUM | 6.4 MEDIUM |
| A vulnerability was detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. Impacted is an unknown function of the component UART Interface. The manipulation results in missing authentication. An attack on the physical device is feasible. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-1364 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative functionalities. | |||||
| CVE-2026-1341 | 2026-06-17 | N/A | N/A | ||
| Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control. | |||||
| CVE-2026-1332 | 1 Hamastar | 1 Meetinghub Paperless Meetings | 2026-06-17 | N/A | 5.3 MEDIUM |
| MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functions and obtain meeting-related information. | |||||