Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE...
CVE-2026-103091
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (H
#severity:critical
共收录 1449 条相关情报。
← 返回所有主题A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
CVE-2026-108983
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn...
CVE-2026-111911
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
CVE-2026-105192
### Summary LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiproce
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
CVE-2026-96620
The Claude Agent SDK for Python passed the `resume` option to the Claude CLI without validation, allowing a value beginn
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code...
CVE-2026-111356
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthentica
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow...
CVE-2026-111329
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows...
CVE-2026-111322
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to ac
BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass...
CVE-2026-111283
BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthen
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code...
CVE-2026-111281
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that a
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the...
CVE-2026-111312
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id]
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
CVE-2026-102989
## Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someon
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
CVE-2026-94603
### Impact Podman v4.4.0 added a feature where container checkpoints (from the `podman container checkpoint` command) co
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
CVE-2026-77524
## Summary A namespace admin who creates a `TriggerAuthentication` and a `ScaledObject` in their own namespace can make
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
CVE-2026-77459
### Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers dest
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
CVE-2026-102748
### Summary Dgraph `v25.3.8` exposes a Zero HTTP administrative surface that is unauthenticated when port `6080` is rea
Vitess vttablet /twopcz reflected XSS
CVE-2026-104252
From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in...
CVE-2026-110864
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin th
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to...
CVE-2026-110867
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environmen
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that...
CVE-2026-110862
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated