xrdp: No authentication required with Xvnc backend on RHEL 9
CVE-2026-55626
xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using
#cwe-306
共收录 1261 条相关情报。
← 返回所有主题WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration
CVE-2026-46555
WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp mes
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` ...
CVE-2026-63429
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no
HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context
CVE-2026-63429
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts a...
CVE-2026-63757
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns at
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-bas...
CVE-2026-16242
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was
Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication
CVE-2026-54246
## Description The `routesrv` component exposes the full cluster route topology (Ingress/RouteGroup configurations, bac
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access...
CVE-2026-9103
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authenti
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endp...
CVE-2026-9103
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authenti
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user...
CVE-2026-9202
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow
Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows...
CVE-2026-63101
Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers t
Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video...
CVE-2026-12691
Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authenticat
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deplo...
CVE-2026-9202
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow
Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, includi...
CVE-2026-63101
Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers t
Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform...
CVE-2026-12691
Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authenticat
TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending...
CVE-2026-63098
TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated atta
Open Event Server 1.19.1 Unauthenticated Member Roster Export via CSV Export Endpoint
CVE-2026-63101
Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers t
TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint
CVE-2026-63098
TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated atta
A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/tasks.py of the comp...
CVE-2026-16015
A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
CVE-2026-16015
A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of