Astra Security
2026
- CVE-2026-92580: AVideo CloneSite stored OS command injection
- CVE-2026-92729: SigNoz trace-funnel analytics exposed without authentication
- CVE-2026-63126: Wire protobuf length overflow can cause denial of service
- CVE-2026-92717: Covenant unauthenticated listener creation exposes operator APIs
- CVE-2026-76187: Apache Airflow Keycloak provider cross-client authentication bypass
- CVE-2026-78088: Contest Gallery authenticated file overwrite
- CVE-2026-76969: SAP CAP login helper exposes a privileged access token
- CVE-2026-86262: Unauthenticated Order Modification and Disclosure in hosp_order
- CVE-2026-86260: Account Takeover via Unverified Password Recovery in hosp_order
- CVE-2026-86239: Unauthenticated File Upload in FeehiCMS UEditor
- CVE-2026-75816: Unauthenticated user email changes in Frontend Admin for WordPress
- CVE-2026-13448: Unauthenticated Remote Code Execution in Langflow OSS via Public-Flow Blacklist Bypass
2021
- CVE-2021-43798: Unauthenticated Path Traversal in Grafana's Plugin Static Resource Route