| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A flaw in Portal for ArcGIS allows unauthenticated access to certain /portaladmin/local API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication. |
| Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /config_dump endpoint to read configured LLM provider API keys in plaintext from the WASM filter configuration. |
| A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site. |
| fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes. |
| Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network. |
| Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally. |
| Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally. |
| Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally. |
| Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. |
| Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally. |
| Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally. |
| Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. |
| Improper access control in Windows Notification allows an authorized attacker to disclose information locally. |
| Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally. |
| Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
| Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally. |
| Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally. |
| An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only). |
| SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication. |
