NetLicensing MCP Server: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
CVE-2026-54446
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensi
#cwe-306
共收录 1259 条相关情报。
← 返回所有主题SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the ...
CVE-2026-92972
SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefi
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces th...
CVE-2026-71568
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requir
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote ...
CVE-2026-81475
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Functio
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with local a...
CVE-2026-81441
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Functio
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require...
CVE-2026-50608
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense.
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonc...
CVE-2026-86801
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress an
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authen...
CVE-2026-50604
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The
TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an...
CVE-2026-89034
TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low En
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport authorizes ...
CVE-2026-61594
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to
djust has an authorization bypass on the WebSocket/SSE mount path
CVE-2026-61594
### Impact The live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on...
CVE-2026-92805
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in Conf
A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrat...
CVE-2026-76447
A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an
A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause the server to is...
CVE-2026-92808
A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An un
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security revie...
CVE-2026-20326
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering t
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attack...
CVE-2026-92720
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated a
djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG
CVE-2026-61590
### Impact djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command e...
CVE-2026-86106
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions with
XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve the configuration data containing network configurations a...
CVE-2026-88263
XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve t
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability...
CVE-2026-88065
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions