: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32...
CVE-2026-71448
: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abus
#cwe-1188
共收录 133 条相关情报。
← 返回所有主题: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affects EasyIO FS32: before 3.0b63.
CVE-2026-71448
: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abus
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
CVE-2026-92950
### Summary The `vm2` command-line tool installed by `npm install -g vm2` and documented in the README's "CLI" section r
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an un...
CVE-2026-100291
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview...
CVE-2026-102676
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
CVE-2026-102676
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privilege...
CVE-2026-73596
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource
Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows...
CVE-2026-93354
Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers t
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt:...
CVE-2026-97055
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOK
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or the deprecated SIGNOZ_JWT_SECRET) to...
CVE-2026-97055
SigNoz 是一款开源的可观测性平台。CVE-2026-97055 影响 v0.8.0 起至 v0.143.0 之前的所有版本：其 JWT tokenizer 的签名密钥（配置项 tokenizer::jwt::secret，可通过环境变
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDE...
CVE-2026-86246
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by
Obot: Server-Side Request Forgery via remote MCP server URL
## Summary In affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched s
Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows unauthenticated remote attackers to obtain sensitive system ...
CVE-2026-93338
Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows una
Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registrati...
CVE-2026-54907
Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults secu...
CVE-2026-61793
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthen
PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signing key when PLATFOR...
CVE-2026-57148
PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the p
PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me value to JWT_SECRET when PLATFORM_JW...
CVE-2026-57147
PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public
PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every ...
CVE-2026-57139
PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/serve
Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, ...
CVE-2026-52824
Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the pub
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disable...
CVE-2026-53660
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes