Security news aggregator

Latest coverage for Unauthenticated

Unauthenticated access lets systems or services be used without verifying identity, increasing the risk of data exposure, tampering, or abuse.

9 headlines in this view

Refine the feed

Search across headline titles and summaries.

Tag briefing

Background for this topic.

Unauthenticated describes a request, session, or service that has not verified the requester’s identity. This may be intentional for public content or health checks, but in security reporting the term often highlights an interface that can be reached without credentials, such as an administration panel, API, database, or device-management service. It does not by itself mean the requester is authorized to perform every action; authentication and authorization are separate controls.

Unauthenticated exposure matters when it permits sensitive data retrieval, configuration changes, or exploitation of a vulnerability without a prior login. Security teams should identify such interfaces during asset discovery and vulnerability management, confirm that public access is necessary, and enforce authentication and least-privilege authorization where it is not. Network restrictions, safe defaults, logging, and alerts for unexpected access help reduce exposure and support investigation when an unauthenticated endpoint is abused.

Volume over time

Weekly headline count for the current query.

Showing 9 most recent headlines Filtered view
Security Affairs 5 hours, 25 minutes ago

OpenSSL Fixes HollowByte Memory Exhaustion Bug

Okta disclosed HollowByte, an 11-byte OpenSSL flaw that lets remote attackers exhaust server memory and trigger denial-of-service attacks. Okta’s Red Team disclosed a denial-of-service vulnerability in OpenSSL they named HollowByte, and the attack payload is exactly 11 bytes. A remote, unauthenticated attacker sends that payload and the server allocates up to 131 KB of memory […]

Security Affairs 19 Jul 2026, 6:24 a.m. Disclosure DoS Flaw Okta OpenSSL Unauthenticated Vulnerability
Security Affairs 2 days, 16 hours ago

Zoom Fixes CVE-2026-53412, a Critical Account Takeover Bug

Zoom warns of a critical Windows flaw, tracked as CVE-2026-53412, that could let attackers take over accounts without authentication. Zoom has fixed a critical Windows vulnerability, tracked as CVE-2026-53412 (CVSS score of 9.8) that could allow unauthenticated attackers to hijack user accounts. The flaw affects older versions of Workplace, the Windows VDI Client, and the […]

Security Affairs 16 Jul 2026, 7:36 p.m. Incident · 3 stories CVE-2026-53412 Authentication CVE Fixed Flaw Microsoft Unauthenticated Vulnerability Warning

Attackers are exploiting a critical flaw in Oracle E-Business Suite, CVE-2026-46817, that allows remote, unauthenticated attackers to take over Oracle Payments. A critical vulnerability in Oracle E-Business Suite, tracked as CVE-2026-46817, is being actively exploited in the wild, according to cybersecurity firm Defused Cyber. “CVE-2026-46817 (CVSS 9.8 unauth HTTP takeover in Oracle E-Business) is being […]

Security Affairs 30 Jun 2026, 9:01 p.m. Incident · 4 stories Actively exploited CVE-2026-46817 Critical Vulnerability CVE Exploit Flaw Oracle Unauthenticated Vulnerability

F5 released emergency updates for critical NGINX flaws (CVE-2026-42530, CVE-2026-42055) that could enable unauthenticated code execution. F5 has issued out-of-band patches for multiple NGINX vulnerabilities, including two critical flaws, respectively tracked as CVE-2026-42530 and CVE-2026-42055 (CVSS 9.2). The bugs affect HTTP modules and can be exploited remotely without authentication to trigger memory corruption, potentially causing […]

Security Affairs 19 Jun 2026, 2:07 a.m. Incident · 3 stories CVE-2026-42530 CVE-2026-42055 Authentication Critical Vulnerability CVE F5 Flaw Patch Unauthenticated Vulnerability
Security Affairs 1 month, 1 week ago

Fortinet patched a new critical FortiSandbox flaw

Fortinet patched a critical FortiSandbox vulnerability that could let unauthenticated attackers remotely execute commands via crafted HTTP requests. Fortinet released security updates to address several vulnerabilities affecting FortiSandbox, FortiOS, FortiProxy, and FortiPortal. The most severe issue, tracked as CVE-2026-25089 (CVSS score of 9.8), is an OS command injection flaw in FortiSandbox products. The vulnerability could […]

Security Affairs 11 Jun 2026, 9:51 p.m. Incident · 5 stories Actively exploited CVE-2026-25089 CVE Flaw Fortinet Patch Unauthenticated Vulnerability

Cisco patched a critical Unified CM flaw with public PoC code that allows unauthenticated attackers to launch SSRF attacks remotely. Cisco has addressed a high-severity vulnerability, tracked as CVE-2026-20230, affecting Unified CM and Unified CM SME. The flaw, caused by improper validation of certain HTTP requests, allows a remote attacker without authentication to perform server-side […]

Security Affairs 5 Jun 2026, 1:10 a.m. Incident · 6 stories Actively exploited CVE-2026-20230 Authentication Cisco CVE Exploit Flaw Patch PoC Unauthenticated Vulnerability

Rapid7 details a critical unauthenticated overflow in HP Poly VoIP phones that can lead to root RCE, with patches available for affected models. Rapid7’s latest disclosure on CVE-2026-0826 should get serious attention from anyone running HP Poly VoIP phones in an enterprise setting. It’s a critical unauthenticated stack-based buffer overflow that can give a remote […]

Security Affairs 3 Jun 2026, 5:03 p.m. CVE-2026-0826 CVE Disclosure Patch Remote Code Execution Root Access Unauthenticated VoIP

CVE-2026-8732 in WP Maps Pro lets unauthenticated attackers create WordPress admin accounts. 2,858 attacks blocked in 24 hours. WP Maps Pro plugin allows WordPress site owners to embed Google Maps and OpenStreetMap with markers, listings, and location search. It’s a store locator tool. Unremarkable. The plugin is installed on over 15,000 websites, according to sale […]

Security Affairs 1 Jun 2026, 11:36 p.m. Incident · 3 stories CVE-2026-8732 CVE Flaw Google Unauthenticated Wordpress

Attackers began exploiting Drupal SQL injection flaw CVE-2026-9082 within 48 hours of patch release. Drupal issued a highly critical security patch on May 20 for CVE-2026-9082, a SQL injection vulnerability that allows unauthenticated attackers to compromise sites running PostgreSQL databases. The project maintainers warned ahead of the release that exploits could surface within hours or […]

Security Affairs 24 May 2026, 4:17 a.m. Incident · 3 stories Actively exploited CVE-2026-9082 Compromise CVE Exploit Flaw Patch PostgreSQL SQL Unauthenticated Vulnerability