#cwe-306

共收录 1259 条相关情报。

漏洞预警2026-10-13 发布INFO

NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revoc...

CVE-2026-65173

NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unaut

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-13 发布INFO

NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where the gRPC health-event interface, exposed over a world-writable Unix domain socke...

CVE-2026-65131

NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where the gRPC health-event i

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

安全公告2026-10-13 发布INFO

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf:...

CVE-2026-87689

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::Credential

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-306 #severity:critical

漏洞预警2026-10-13 发布INFO

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet ca...

CVE-2026-87689

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::Credential

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-12 发布INFO

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession...

CVE-2026-84313

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_pas

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-10-12 发布INFO

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement ...

CVE-2026-109571

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaire

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-12 发布INFO

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the pro...

CVE-2026-109570

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaire

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-12 发布INFO

In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drop...

CVE-2026-109575

In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-12 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent...

CVE-2026-57118

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-10-12 发布INFO

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_...

CVE-2026-108921

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2.

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

漏洞预警2026-10-12 发布INFO

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flo...

CVE-2026-109371

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-12 发布INFO

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate ot...

CVE-2026-109342

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows l

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-10-12 发布INFO

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level...

CVE-2026-92681

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Q

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

安全公告2026-10-12 发布INFO

ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1

CVE-2026-109371

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-306

漏洞预警2026-10-12 发布INFO

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insu...

CVE-2026-93693

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations a

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-116 #cwe-306 #cwe-918

漏洞预警2026-10-12 发布INFO

A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependency of the file auth.py. Such manipulation of the argument...

CVE-2026-108818

A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependen

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

安全公告2026-10-11 发布INFO

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows...

CVE-2026-108863

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attack

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-306 #severity:high

安全公告2026-10-11 发布INFO

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication...

CVE-2026-108757

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-r

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-306 #severity:high

漏洞预警2026-10-11 发布INFO

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound t...

CVE-2026-108863

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

安全公告2026-10-11 发布INFO

Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface

CVE-2026-108863

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attack

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-306