A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the atta...

CVE-2026-71297

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificat

历史摘要 · 未重新核验 · NVD

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipul...

CVE-2026-105307

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filt

历史摘要 · 未重新核验 · NVD

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected is an unknow...

CVE-2026-105170

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b

历史摘要 · 未重新核验 · NVD

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and...

CVE-2026-105207

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers

历史摘要 · 未重新核验 · GitHub Advisory

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permi...

CVE-2026-105207

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers

来源摘录 · NVD

ZITADEL before 4.17.3 Account Takeover via External IdP Linking

CVE-2026-105207

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers

历史摘要 · 未重新核验 · OSV.dev

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in...

CVE-2026-105115

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP

历史摘要 · 未重新核验 · GitHub Advisory

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes wi...

CVE-2026-105115

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP

历史摘要 · 未重新核验 · NVD

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and...

CVE-2026-105105

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) i

历史摘要 · 未重新核验 · GitHub Advisory

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthentic...

CVE-2026-105105

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) i

历史摘要 · 未重新核验 · NVD

OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

CVE-2026-105115

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP

历史摘要 · 未重新核验 · OSV.dev

Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration

CVE-2026-105105

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) i

历史摘要 · 未重新核验 · OSV.dev

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate...

CVE-2026-95102

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a res

历史摘要 · 未重新核验 · GitHub Advisory

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and H

历史摘要 · 未重新核验 · GitHub Advisory

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and H

历史摘要 · 未重新核验 · NVD

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

### Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persi

历史摘要 · 未重新核验 · GitHub Advisory

Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

## Summary The POST handler for `/realtime/v1/streams/:runId/:streamId` has no authentication. Any entity that knows or

历史摘要 · 未重新核验 · GitHub Advisory

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthor...

CVE-2026-95102

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a res

历史摘要 · 未重新核验 · NVD

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote...

CVE-2026-82042

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full admini

历史摘要 · 未重新核验 · GitHub Advisory

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Ke...

CVE-2026-82042

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full admini

历史摘要 · 未重新核验 · NVD