#cwe-306

共收录 1259 条相关情报。

← 返回所有主题
漏洞预警2026-09-18 发布INFO

A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An att...

CVE-2026-85478

A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests t...

CVE-2026-77339

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listen

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run ...

CVE-2026-58197

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to Too

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

CVE-2026-58197

## Summary A containerized MCP server running with the default `network` permission profile (`insecure_allow_all: true`

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-18 发布INFO

Forget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication

CVE-2026-93559

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This aff

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-18 发布INFO

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

CVE-2026-77339

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listen

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-18 发布INFO

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

CVE-2026-58197

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to Too

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-18 发布INFO

CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device...

CVE-2026-88259

CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenti

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network w...

CVE-2026-84400

CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote d

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC)...

CVE-2026-79954

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiv

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-18 发布INFO

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS process...

CVE-2026-79954

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiv

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker...

CVE-2026-85889

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges o

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-17 发布INFO

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-85889

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges o

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoint whose chave para...

CVE-2026-54767

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controll...

CVE-2026-54670

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/cont

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId...

CVE-2026-54460

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and...

CVE-2026-54618

Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authoriza

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src/...

CVE-2026-54504

MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13

历史摘要 · 未重新核验 · NVD

安全公告2026-09-17 发布INFO

MCP Documentation Server: Web UI API binds to all interfaces without authentication by default

CVE-2026-54504

MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-17 发布INFO

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, netw...

CVE-2026-54446

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensi

历史摘要 · 未重新核验 · NVD