Apache Airflow before 3.4.0 allows unauthenticated RCE via Celery
A public proof of concept shows a broker message can invoke any importable Python function without Airflow credentials.
Stories per day · 30 days
1 RSS
Relatedapache-kylin2cisa2cwe-3062rce2apache1apache-airflow1apache-answer1apache-pulsar1authorization-bypass1broadcast-api1camera1celery1connect-secure1credential-disclosure1cve-2026-1087711cve-2026-649591cve-2026-909101deserialization1
20 stories, newest first · one card per story
Stories tagged #missing-authentication
Quest Foglight for Databases missing authentication enables remote code execution
ForgeMBeanServerSupport flaw enables unauthenticated remote code execution on Quest Foglight for Databases.
CISA adds exploited Ivanti Connect Secure and GitLab flaws to KEV
CVE-2026-111357 is missing authentication in Ivanti Connect Secure; CVE-2026-97229 is an integer overflow in GitLab CE and EE.
2
Splunk Enterprise Patroni API flaw allows unauthenticated commands
Splunk rates CVE-2026-76268 9.8 and reports no active exploitation; a public repository offers claimed PoC code.
Apache Pulsar Manager missing auth leaks admin credentials (CVE-2026-105944)
The Apache Pulsar PMC says the end-of-life manager lacks authentication and authorization and can expose Pulsar admin credentials.
CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content
Apache Answer through 2.0.2 lets unauthorized users read or change reaction metadata on restricted content.
CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
Apache Kylin’s broadcast API lacks authentication and allows polymorphic deserialization through 5.0.4.
CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints
Apache Kylin 5.0.0–5.0.4 cache APIs lack authentication and allow SQL injection.
Swann Communications SWIFI-SE2KIC
Swann SWIFI-SE2KIC firmware through 2.0.22 can expose live video without authentication on the local network.
Hitachi Energy Asset Suite
Hitachi Energy Asset Suite 9.9.0 and earlier expose unauthenticated servlets that can leak data or disrupt availability.
2
Critical Dell Container Storage Flaws Let Unauthenticated Attackers Gain Full Administrative Control
Dell patched multiple critical Container Storage Module flaws, including two CVSS 10.0 bugs that let unauthenticated attackers seize administrative control.
8
WatchGuard security advisory (AV26-990)
WatchGuard Endpoint Security kernel driver flaw CVE-2026-13043 allows arbitrary kernel memory access.
CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering
Apache Roller 6.1.5 lets unauthenticated attackers persistently change the site frontpage weblog selection.
mySCADA myPRO Manager
CISA advisory reveals unauthenticated privileged API access and arbitrary SMS sending in mySCADA myPRO Manager <=2.1, CVSS 9.8.
CareCam CM2507
CISA advisory: seven flaws in CareCam CM2507 IP cameras enable unauthenticated live video access, privileged ONVIF control, credential recovery, and code execution.
CVE-2026-49362: Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
CVE-2026-49362: unauthenticated attackers can create arbitrary durable queues in ActiveMQ Artemis via the CORE protocol, enabling denial of service.
Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking
CERT/CC warns Skullcandy Dime 3 earbuds accept silent Bluetooth pairings via CVE-2025-20701, letting nearby attackers hijack audio and microphone.
Tycon Systems TPDIN-Monitor-WEB2 (Update A)
CISA details CVE-2026-61884 (CVSS 9.8) in Tycon Systems TPDIN-Monitor-WEB2: unauthenticated access to power relays when credentials are unset; fixed in 2.4.5.
1
VU#756733: Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability
CERT/CC warns Calix GS7 XGS GS5239XG routers on firmware EXOS/6.6.47 expose an unauthenticated UPnP WANIPConnection service on the public WAN interface.
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.