Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` w...

CVE-2026-54061

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for e

历史摘要 · 未重新核验 · NVD

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

CVE-2026-54061

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for e

历史摘要 · 未重新核验 · OSV.dev

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows...

CVE-2026-59705

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers t

历史摘要 · 未重新核验 · GitHub Advisory

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and...

CVE-2026-59706

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request f

历史摘要 · 未重新核验 · GitHub Advisory

ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path

### Summary In add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path **and** at the bar

历史摘要 · 未重新核验 · GitHub Advisory

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by acce...

CVE-2026-59705

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers t

历史摘要 · 未重新核验 · NVD

An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAccessTokenComponent.ja...

CVE-2026-51937

An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsAp

历史摘要 · 未重新核验 · NVD

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter....

CVE-2026-59706

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request f

历史摘要 · 未重新核验 · NVD

mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints

CVE-2026-59705

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers t

历史摘要 · 未重新核验 · OSV.dev

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated...

CVE-2026-58473

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite

历史摘要 · 未重新核验 · GitHub Advisory

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registerin...

CVE-2026-58473

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite

历史摘要 · 未重新核验 · NVD

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticate...

CVE-2026-49471

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2,

历史摘要 · 未重新核验 · NVD

mem0 - Server-Side Request Forgery and Plaintext API Key Exposure via Unauthenticated Config Endpoints

CVE-2026-59706

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request f

历史摘要 · 未重新核验 · OSV.dev

Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

CVE-2026-49471

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2,

历史摘要 · 未重新核验 · OSV.dev

Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings

CVE-2026-58473

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite

历史摘要 · 未重新核验 · OSV.dev

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

CVE-2026-53512

### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` and has

历史摘要 · 未重新核验 · GitHub Advisory

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without a...

CVE-2026-53647

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `ser

历史摘要 · 未重新核验 · NVD

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate li...

CVE-2026-41899

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats

--- title: Unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats product: 9Router version: /

历史摘要 · 未重新核验 · GitHub Advisory

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN c...

CVE-2026-42341

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenti

历史摘要 · 未重新核验 · NVD