Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint, unlike the POST a...

CVE-2026-56321

Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /

历史摘要 · 未重新核验 · NVD

Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3...

CVE-2026-41047

Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacke

历史摘要 · 未重新核验 · GitHub Advisory

Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacker to see otherwise read protected information.

CVE-2026-41047

Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacke

历史摘要 · 未重新核验 · NVD

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allowing a remote unaut...

CVE-2026-6673

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlas

历史摘要 · 未重新核验 · NVD

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId...

CVE-2026-56299

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 erro...

CVE-2026-56299

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows

历史摘要 · 未重新核验 · NVD

A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SS...

CVE-2026-12795

A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm

历史摘要 · 未重新核验 · NVD

AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage...

CVE-2026-56346

AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that

历史摘要 · 未重新核验 · GitHub Advisory

AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Re...

CVE-2026-56346

AVideo 版本 25.0（及更早版本）的 decryptMessage.json.php 端点存在认证绕过漏洞。未经身份验证的远程攻击者可向该端点提交私钥、密文和口令，在服务器端执行 PGP 解密操作，而无需任何有效凭据。该漏洞不仅导致

历史摘要 · 未重新核验 · NVD

dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

CVE-2026-55837

## Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens ### Summary The local OAuth helper FastAPI server

历史摘要 · 未重新核验 · GitHub Advisory

There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback.  This may allow an unauth...

CVE-2026-9142

There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the s

历史摘要 · 未重新核验 · NVD

Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on Windows or Mac via...

CVE-2026-49357

Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly o

历史摘要 · 未重新核验 · NVD

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to admin...

CVE-2026-50242

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authenti

历史摘要 · 未重新核验 · NVD

Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/...

CVE-2026-12046

Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/ and POST /sqleditor/initial

历史摘要 · 未重新核验 · GitHub Advisory

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to...

CVE-2026-54130

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information ove

历史摘要 · 未重新核验 · GitHub Advisory

Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<d...

CVE-2026-12046

pgAdmin 4 的 SQL 编辑器蓝图中的两个端点（DELETE /sqleditor/close/<trans_id> 和 POST /sqleditor/initialize/sqleditor/update_connection/

历史摘要 · 未重新核验 · NVD

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2026-54130

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information ove

历史摘要 · 未重新核验 · NVD

mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server ...

CVE-2026-49257

mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and

历史摘要 · 未重新核验 · NVD

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and...

CVE-2026-54103

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contrac

历史摘要 · 未重新核验 · GitHub Advisory

AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)

## Summary Two inbound-mail handlers act on a privileged effect without verifying that the sender is the operator, while

历史摘要 · 未重新核验 · GitHub Advisory