#cwe-306

共收录 1259 条相关情报。

漏洞预警2026-10-11 发布INFO

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/...

CVE-2026-108757

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-r

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-11 发布INFO

docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts becaus...

CVE-2026-108749

docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-11 发布INFO

OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/w...

CVE-2026-108739

OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unaut

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

安全公告2026-10-11 发布INFO

docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints

CVE-2026-108749

docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attacker

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-306

漏洞预警2026-10-10 发布INFO

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates whe...

CVE-2026-108549

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in pla

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

安全公告2026-10-10 发布INFO

cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing

CVE-2026-108549

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in pla

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-306

漏洞预警2026-10-09 发布INFO

Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /...

CVE-2026-108263

Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow co

历史摘要 · 未重新核验 · NVD

#cve #cwe-95 #cwe-306 #cwe-653 #cwe-863 #cwe-1392

漏洞预警2026-10-09 发布INFO

x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes al...

CVE-2026-107824

x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functional

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

安全公告2026-10-09 发布INFO

x64dbg-MCP Server exposes debugger operations to unauthenticated network clients

CVE-2026-107824

x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functional

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-306

漏洞预警2026-10-09 发布INFO

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint....

CVE-2026-75597

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/` route in `src/

历史摘要 · 未重新核验 · NVD

#cve #cwe-209 #cwe-306

安全公告2026-10-09 发布INFO

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

CVE-2026-75597

### Summary The `/web/` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without an

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-209 #cwe-306 #severity:medium

漏洞预警2026-10-09 发布INFO

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgr...

CVE-2026-33367

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or de

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-09 发布INFO

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this...

CVE-2026-85479

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-09 发布INFO

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this i...

CVE-2026-105281

The internal data publisher on openPDC accepts network connections without authentication in its default configuration.

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-09 发布INFO

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacke...

CVE-2026-78025

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Cr

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

安全公告2026-10-09 发布INFO

Missing authentication for critical function in Azure App Service allows an unauthorized attacker...

CVE-2026-77900

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-306 #severity:critical

安全公告2026-10-09 发布INFO

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary...

CVE-2026-84249

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations d

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-306 #severity:critical

漏洞预警2026-10-08 发布INFO

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.

CVE-2026-77900

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-08 发布INFO

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.

CVE-2026-84249

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations d

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

安全公告2026-10-08 发布INFO

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

CVE-2026-61426

## Summary The AgentOS server in the `praisonai` TypeScript/npm package ships an insecure default: it binds `0.0.0.0`,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-200 #cwe-284 #cwe-306 #severity:high