共收录 1261 条相关情报。
← 返回所有主题CVE-2026-81094
The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked
CVE-2026-80208
APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with
CVE-2026-80207
APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. Reso
CVE-2026-81735
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was g
CVE-2026-81664
The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each admi
CVE-2026-81098
The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mc
CVE-2026-81094
The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked
CVE-2026-80208
APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with
CVE-2026-80207
APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. Reso
CVE-2026-16646
Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.
CVE-2026-65105
NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote attacker may access the
CVE-2026-55605
## Summary The self-hosted HTTP transport of `@arikusi/deepseek-mcp-server` exposes `POST /mcp` without any authenticati
CVE-2026-55571
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to
CVE-2026-55640
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.11
CVE-2026-55539
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs
CVE-2026-55533
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=a
CVE-2026-55571
### Impact djust's `LiveViewConsumer` mounts a `LiveView` over a WebSocket. When a view is gated (`login_required` / `p
CVE-2026-55538
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config["api_key"] but
CVE-2026-55534
PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key bu
CVE-2026-55529
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts