#cwe-306

共收录 1261 条相关情报。

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route....

CVE-2026-55528

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token bu

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-08-25 发布INFO

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics wi...

CVE-2026-79668

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows una

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-25 发布INFO

Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.

CVE-2026-57910

Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agen

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-347 #cwe-494

漏洞预警2026-08-25 发布INFO

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system.

CVE-2026-57909

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to e

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-306

漏洞预警2026-08-25 发布INFO

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter so...

CVE-2026-67578

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-24 发布INFO

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpdesk/FormController....

CVE-2026-78434

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-08-24 发布INFO

rConfig Core 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileg...

CVE-2026-77915

rConfig Core 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers t

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-1188

漏洞预警2026-08-24 发布INFO

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypt...

CVE-2026-78369

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint p

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-24 发布INFO

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrativ...

CVE-2026-6017

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sens

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-24 发布INFO

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the...

CVE-2026-78306

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth rang

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-24 发布INFO

The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictab...

CVE-2026-78255

The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-24 发布INFO

NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality to send emails to a...

CVE-2026-19853

NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-24 发布INFO

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/v1/user_invitation...

CVE-2026-78154

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_c

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

安全公告2026-08-23 发布INFO

the-momentum open-wearables Public Invitation-Code Redemption Endpoint user_invitation_code.py redeem_invitation_code missing authentication

CVE-2026-78154

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_c

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287 #cwe-306

漏洞预警2026-08-22 发布INFO

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_que...

CVE-2026-59808

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() retur

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-21 发布LOW

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver....

CVE-2026-48106

CVE-2026-48106 影响 Arc（一个开源的、SQL 原生时间序列数据库）的 Enterprise 集群复制功能。在版本 26.06.1 之前，位于 internal/cluster/replication/receiver.go

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-345 #cwe-924

漏洞预警2026-08-21 发布MEDIUM

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` i...

CVE-2026-48050

CVE-2026-48050 涉及 Arc 时间序列数据库（一个面向遥测数据的 SQL 原生时序数据库）中的一个安全漏洞。在 26.06.1 之前的版本中，Arc 在 internal/api/server.go 中通过 app.Use(p

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-306 #cwe-400

漏洞预警2026-08-21 发布MEDIUM

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setu...

CVE-2026-34949

该漏洞影响 Combodo iTop，一个基于 Web 的 IT 服务管理工具。在 3.2.3 版本之前，存在一个安全缺陷：未认证的远程攻击者能够删除 iTop 实例中的 .readonly 文件。该文件是安装过程中自动创建的标记文件，其作

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-08-21 发布INFO

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env...

CVE-2026-34741

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated rem

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

安全公告2026-08-21 发布INFO

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior...

CVE-2026-69228

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remot

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-306 #severity:medium