#cwe-306

共收录 1259 条相关情报。

漏洞预警2026-11-01 发布HIGH

A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. This manipulation causes missing authen...

CVE-2026-120191

A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of t

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-287 #cwe-306 #severity:medium

漏洞预警2026-10-30 发布INFO

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary or...

CVE-2026-63399

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operati

来源摘录 · NVD

#cve #cwe-306 #cwe-799

漏洞预警2026-10-30 发布INFO

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessib...

CVE-2026-63396

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布CRITICAL

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api...

CVE-2026-63377

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布CRITICAL

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate ...

CVE-2026-62863

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its

来源摘录 · NVD

#cve #cwe-306 #cwe-942

漏洞预警2026-10-30 发布INFO

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `reg...

CVE-2026-62302

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `re

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布HIGH

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server...

CVE-2026-62264

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1,

来源摘录 · NVD

#cve #cwe-200 #cwe-287 #cwe-306

漏洞预警2026-10-30 发布MEDIUM

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because ...

CVE-2026-119705

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthen

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布CRITICAL

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated `/scoutsuite-report` `Static...

CVE-2026-61730

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected depl

来源摘录 · NVD

#cve #cwe-200 #cwe-306 #cwe-522 #cwe-552

漏洞预警2026-10-30 发布CRITICAL

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `verify_graylog_header` in `backend/app/active_response/...

CVE-2026-61729

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76,

来源摘录 · NVD

#cve #cwe-306 #cwe-798

漏洞预警2026-10-30 发布MEDIUM

Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network acc...

CVE-2026-111500

Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerabili

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布INFO

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service pas...

CVE-2026-22110

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brut

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-30 发布INFO

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthentica...

CVE-2026-82104

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 thr

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-29 发布INFO

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.

CVE-2026-92744

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as

来源摘录 · NVD

#cve #cwe-295 #cwe-306

安全公告2026-10-29 发布HIGH

@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

CVE-2026-62264

### Impact When `@sylphx/pdf-reader-mcp` is run as an HTTP server (`MCP_TRANSPORT=http`), it reads the `MCP_API_KEY` en

来源摘录 · GitHub Advisory

#advisory #cwe-200 #cwe-287 #cwe-306 #npm #severity:high

漏洞预警2026-10-29 发布MEDIUM

Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentially cause the Network Agent module of K...

CVE-2026-88941

Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerabil

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-29 发布HIGH

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor...

CVE-2026-113387

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secre

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-306 #severity:high

漏洞预警2026-10-28 发布HIGH

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `v...

CVE-2026-61571

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control

来源摘录 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-10-28 发布CRITICAL

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs end...

CVE-2026-118690

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attacke

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-28 发布CRITICAL

FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privile...

CVE-2026-63190

FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, f

来源摘录 · NVD

#cve #cwe-200 #cwe-22 #cwe-288 #cwe-306 #cwe-79