Remote Code Execution - Unauthenticated Remote Command Injection (via Microsoft SharePoint CVE-2019-0604) Analysed #534630 Valid U.S. Dept Of Defense Command and Code Injection High 2020-05-11 – 13 Unauthenticated clients can modify Livechat Business Hours Analysed #1063164 Valid Rocket.Chat Access Control Medium 2024-08-10 – 13 Unauthorized Access to Internal Server Panel without Authentication Analysed #1548067 Valid U.S. Dept Of Defense Access Control Medium 2022-06-27 – 13 Unauthenticated access to internal API at██████████.███.edu [HtUS] Analysed #1627980 Valid U.S. Dept Of Defense Access Control High 2024-07-19 – 13 [oneclickdrsfdc-test.informatica.com] Tomcat Example Scripts Exposed Unauthenticated Analysed #147161 Valid Informatica Authentication Low 2016-11-02 – 14 Unauthenticated Access to Admin Panel Functions at https://███████/███ Analysed #1397564 Valid U.S. Dept Of Defense Access Control Critical 2021-11-29 – 14 [U.S. Air Force] Information disclosure due unauthenticated access to APIs and system browser functions Analysed #1822160 Valid U.S. Dept Of Defense Misconfiguration and Insecure Design Medium 2023-01-27 – 14 Pre-authentication `size_t` integer underflow → out-of-bounds read / server crash in MariaDB `caching_sha2_password` (auth_mysql_sha2) via an RSA-OAEP Analysed #3781201 Valid MariaDB Memory Corruption Medium 2026-10-07 – 14 Unauth RCE on Jenkins Instance at https://█████████/ Analysed #1125329 Valid U.S. Dept Of Defense Command and Code Injection Critical 2021-03-24 – 15 Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfm Analysed #1164854 Valid Acronis Access Control Medium 2022-06-07 $250 15 Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections Analysed #3303283 Valid Nextcloud Server-Side Request Forgery Medium 2026-09-17 – 15 Sidekiq web UI (Ruby background processing) accessible unauthenticated via https://gift-test.starbucks.co.jp/sidekiq/busy Analysed #423286 Valid Starbucks Access Control Medium 2018-10-24 – 16 LDAP anonymous access enabled at certrep.pki.state.gov:389 Analysed #1869184 Valid U.S. Department of State Access Control Medium 2023-05-11 – 16 Unauthenticated cache purging Analysed #1911568 Valid Fastly VDP Access Control None 2023-05-01 – 16 Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports Analysed #3871816 Valid WordPress Access Control High 2026-11-05 – 16 GraphQL introspection query works through unauthenticated WebSocket Analysed #862835 Valid Nuri Misconfiguration and Insecure Design Medium 2021-01-09 – 17 IDOR + Account Takeover [UNAUTHENTICATED] Analysed #1004750 Valid U.S. Dept Of Defense Insecure Direct Object Reference Critical 2020-11-09 – 17 Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io` Analysed #1591412 Valid GitLab Access Control Medium 2022-09-22 – 17 Unauthenticated SSRF in 3rd party module "cerdic/csstidy" Analysed #1595006 Valid Nextcloud Server-Side Request Forgery Medium 2022-09-03 $250 17 Elasticsearch is currently open without authentication on https://██████l Analysed #2231261 Valid U.S. Dept Of Defense Information Disclosure Medium 2023-12-21 – 17 Unauthenticated arbitrary file upload on the https://█████/ (█████████) Analysed #698789 Valid U.S. Dept Of Defense Misconfiguration and Insecure Design High 2024-08-16 – 19 https://██████ vulnerable to CVE-2020-3187 - Unauthenticated arbitrary file deletion in Cisco ASA/FTD Analysed #1031437 Valid U.S. Dept Of Defense Authentication Critical 2020-11-23 – 19 all private tokens are leaked to an unauthenticated attacker Analysed #268794 Valid GitLab Access Control Critical 2017-09-21 – 20 Pre-Auth Blind NoSQL Injection leading to Remote Code Execution Analysed #1130721 Valid Rocket.Chat No weakness recorded Critical 2021-05-18 – 20 unauth mosquitto ( client emails, ips, license keys exposure ) Analysed #1578574 Valid Acronis Access Control Medium 2022-07-18 $150 20 [www.zomato.com] Unauthenticated access to Internal Sales Data of Zomato through an unrestricted endpoint Analysed #263535 Valid Eternal Authentication – 2017-10-27 – 21 Unauth IDOR to mass account takeover without user interaction on the ███████ (https://███████.edu/) Analysed #685338 Valid U.S. Dept Of Defense Insecure Direct Object Reference High 2024-07-19 – 22 Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint Analysed #3801107 Valid WordPress Access Control Critical 2026-10-12 – 23 Anonymous access control - Payments Status Analysed #1546726 Valid Omise Access Control Medium 2022-08-07 $100 26 Unauthenticated request smuggling on launchpad.37signals.com Analysed #867577 Valid Basecamp Injection and Smuggling Critical 2020-10-28 – 27 ..; bypass leading to tomcat scripts [Unauthenticated] Analysed #1004007 Valid Informatica Access Control Medium 2020-10-13 – 27 Docker Registry without authentication leads to docker images download Analysed #1989884 Valid U.S. Dept Of Defense Access Control Medium 2023-06-23 – 27 Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields Analysed #4152553 Valid WordPress Information Disclosure High 2026-11-05 – 27 Unauthenticated Blind SSRF at https://█████ via xmlrpc.php file Analysed #1890719 Valid U.S. Dept Of Defense Server-Side Request Forgery High 2023-04-14 – 28 Unauthenticated Users Can Access Other Users’ Bug Report Attachments via Broken Access Control Analysed #3259610 Valid U.S. Dept Of Defense Insecure Direct Object Reference High 2026-01-12 – 28 Unauthenticated SSRF in Voxtelesys integration ('checkUrlForSsrf' Bypass via DNS rebinding) Analysed #3473145 Valid Rocket.Chat Server-Side Request Forgery High 2026-07-29 – 28 Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor data Analysed #4071064 Valid Essity Authentication Medium 2026-10-14 – 29 Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464) Analysed #1248052 Valid U.S. Dept Of Defense Command and Code Injection High 2023-12-21 – 30 Unauthenticated RCE in Vaultpress Analysed #236552 Valid Automattic No weakness recorded Critical 2017-09-15 – 31 wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list Analysed #3933198 Valid WordPress Open Redirect Medium 2026-10-30 – 31 Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open Redirect Analysed #3966599 Valid AWS VDP Authentication Medium 2026-10-16 – 32 Unauthenticated phpinfo()files could lead to ability file read at h2f54.n1.ips.mtn.co.ug [/dashboard/] Analysed #2610478 Valid MTN Group Misconfiguration and Insecure Design Medium 2025-02-20 – 33 Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate Analysed #3898281 Valid Weblate Denial of Service High 2026-09-04 – 33 Unauthenticated file deletion via deleteFileMessage DDP method allows permanent destruction of any uploaded file Analysed #3611837 Valid Rocket.Chat Authentication High 2026-06-16 – 34 Unauthenticated Jenkins instance exposed information related to █████ Analysed #2178941 Valid U.S. Dept Of Defense Authentication High 2024-01-26 – 38 Unauthenticated testing endpoint of notify_push expose internal IP Analysed #3513471 Valid Nextcloud Information Disclosure Medium 2026-09-05 $150 38 CVE-2020-3452 - unauthenticated file read on anyconnect.routematch.com Analysed #1257100 Valid Uber File and Path Handling Medium 2021-08-05 – 39 POOL_UPGRADE request handler may allow an unauthenticated attacker to remotely execute code on every node in the network. Analysed #1705717 Valid Linux Foundation Decentralized Trust Command and Code Injection Critical 2022-10-20 $2,000 39 Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin Actions Analysed #3601469 Valid Monero Authentication High 2026-08-17 – 40 DoD workstation exposed to internet via TinyPilot KVM with no authentication Analysed #2633988 Valid U.S. Dept Of Defense Access Control Critical 2024-08-16 – 41