CVE & Exploit Intelligence Database

CVE-2026-2249 9.8 CRITICAL 2 PoCs Analysis EPSS 0.00

METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the software, granting unauthorized access to modify configuration, read and alter sensitive data, or disrupt services.

CWE-306 Feb 11, 2026

CVE-2026-2248 9.8 CRITICAL 1 PoC Analysis EPSS 0.00

METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations

CWE-306 Feb 11, 2026

CVE-2025-8025 9.8 CRITICAL EPSS 0.00

Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dinosoft ERP: from < 3.0.1 through 11022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE-284 Feb 11, 2026

CVE-2026-1603 8.6 HIGH KEV NUCLEI EPSS 0.44

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

CWE-306 Feb 10, 2026

CVE-2026-25938 9.8 CRITICAL 1 Writeup EPSS 0.00

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.

CWE-290 Feb 09, 2026

CVE-2026-25895 9.8 CRITICAL 1 Writeup EPSS 0.00

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

CWE-22 Feb 09, 2026

CVE-2026-25885 7.5 HIGH 1 Writeup EPSS 0.00

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-16 and earlier, the group chat WebSocket at wss://polarlearn.nl/api/v1/ws can be used without logging in. An unauthenticated client can subscribe to any group chat by providing a group UUID, and can also send messages to any group. The server accepts the message and stores it in the group’s chatContent, so this is not just a visual spam issue.

CWE-306 Feb 09, 2026

CVE-2026-25878 5.3 MEDIUM 1 Writeup EPSS 0.00

FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. This vulnerability is fixed in 2.2.1.

CWE-306 Feb 09, 2026

CVE-2026-25791 7.5 HIGH EPSS 0.00

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.

CWE-306 Feb 09, 2026

CVE-2026-25848 9.1 CRITICAL EPSS 0.00

In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

CWE-306 Feb 09, 2026

CVE-2026-2234 9.1 CRITICAL EPSS 0.00

C&Cm@il developed by HGiga has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read and modify any user's mail content.

CWE-306 Feb 09, 2026

CVE-2026-2165 7.3 HIGH 2 Writeups EPSS 0.00

A weakness has been identified in detronetdip E-commerce 1.0.0. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the component Account Creation Endpoint. Executing a manipulation of the argument email can lead to missing authentication. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CWE-287 Feb 08, 2026

CVE-2020-37157 7.5 HIGH 1 PoC Analysis EPSS 0.00

DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unprotected configuration backup endpoint. Attackers can download the configuration file and extract hardcoded username and password by accessing the /tmpfs/config_backup.bin resource.

CWE-306 Feb 07, 2026

CVE-2020-37146 7.5 HIGH 1 PoC Analysis EPSS 0.00

ACE Security WiP-90113 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration files. Attackers can access the camera's configuration backup by sending a GET request to the /config_backup.bin endpoint, exposing credentials and system settings.

CWE-306 Feb 07, 2026

CVE-2026-25593 8.4 HIGH EPSS 0.00

OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20.

CWE-78 Feb 06, 2026

CVE-2026-2065 6.3 MEDIUM 1 Writeup EPSS 0.00

A security flaw has been discovered in Flycatcher Toys smART Pixelator 2.0. Affected by this issue is some unknown functionality of the component Bluetooth Low Energy Interface. Performing a manipulation results in missing authentication. The attack can only be performed from the local network. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CWE-306 Feb 06, 2026

CVE-2026-25751 7.5 HIGH EPSS 0.00

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

CWE-306 Feb 06, 2026

CVE-2026-25505 9.8 CRITICAL 1 Writeup EPSS 0.00

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patched in version 0.1.7.

CWE-321 Feb 04, 2026

CVE-2026-1633 10.0 CRITICAL 1 Writeup EPSS 0.00

The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, allowing unauthenticated users to modify critical device settings or factory reset the device.

CWE-306 Feb 04, 2026

CVE-2026-1632 9.1 CRITICAL 1 Writeup EPSS 0.00

MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication, which could allow an unauthenticated attacker to modify configuration settings, acquire device data or remotely reset the device.

CWE-306 Feb 03, 2026