Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver
CVE-2026-93539
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is no
#cwe-306
共收录 1259 条相关情报。
← 返回所有主题mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthe...
CVE-2026-82930
mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocke
The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthenticated remote attacker to trigger a...
CVE-2026-52748
The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. Th
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the front...
CVE-2026-82383
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persist
Apache Roller: Anonymous setup action allows frontpage configuration tampering
CVE-2026-82383
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persist
A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the co...
CVE-2026-101004
A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the fun
A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipul...
CVE-2026-100903
A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/o
Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970,...
CVE-2026-101065
Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart
Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts the container lis...
CVE-2026-101065
Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart
A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file loginlinkstudent...
CVE-2026-100876
A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Aff
A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App ...
CVE-2026-100746
CVE-2026-100746 影响 coollabsio Coolify 4.1.0 及更早版本,问题出在 GitHub App 设置处理流程中的重定向功能 Github::redirect,对应 HTTP 路由为 /webhooks/s
The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication ch...
CVE-2026-100672
The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that r
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
CVE-2026-57443
### Summary The AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools
CVE-2026-86439
## Overview Verified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memo
The Botslab G980H dash camera firmware does not require authenticated pairing or client binding...
CVE-2026-84403
The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access
The Botslab G980H dash camera firmware contains an authentication vulnerability in the root...
CVE-2026-88956
The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the
Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing...
CVE-2026-81455
Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
CVE-2026-61742
### Summary DBHub `0.21.2` exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registere...
CVE-2026-86064
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSock
Klever-Go: /log controls global node logging
CVE-2026-86064
An unauthenticated client can connect to `GET /log`, send an arbitrary logger profile as the first WebSocket message, an