CVE-2026-82930 Missing Authentication in mH-DEVELOPER

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

CVE-2026-82930 Missing Authentication in mH-DEVELOPER

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

ROOT-APP-NPM-CVE-2024-37890 CVE-2024-37890 in ws - Patched by Root

Root has patched CVE-2024-37890 in the ws package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-48779 CVE-2026-48779 in ws - Patched by Root

Root has patched CVE-2026-48779 in the ws package for Root:npm. Multiple fixed versions available...

CVE-2026-44578

🚨 CVE-2026-44578 — Next.js SSRF 漏洞 📌 概述 CVE-2026-44578 是一个影响自托管 Next.js 应用的高严重性 服务端请求伪造 SSRF 漏洞。 攻击者可以利用精心构造的 WebSocket 升级请求 ，强制服务器向内部或外部系统发起出站请求。 ⚠️ 影响 此漏洞可能允许攻击者访问： 目标| 风险 ---|--- 🔐 内部 API| 未授权的内部访问 ☁️ 云元数据端点| 凭证泄露 🖥 管理接口| 权限提升 🌐 网络资源| 内部侦察 🧠 攻击流程 Attacker │ ▼ Crafted WebSocket Upgrade Request │...

CVE-2026-82932: Improper Restriction of Communication Channel to Intended Endpoints

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...

CVE-2026-82930: Missing Authentication for Critical Function

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

Marimo 0.20.4 Terminal WebSocket Authentication Bypass

Marimo versions before 0.23.0 contain a missing authentication vulnerability in the terminal WebSocket endpoint that may allow unauthenticated remote command execution...

CVE-2026-101061

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

EUVD-2026-87986

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

CVE-2026-101061

The utcp-gql and utcp-websocket libraries, in versions before 1.1.1 , are vulnerable to server-side request forgery (SSRF) . The vulnerability stems from an incomplete application of fixes for CVE-2026-44661. Specifically, the GraphQL plugin utilizes a flawed prefix check that allows bypasses usi...

CVE-2026-101061 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

CVE-2026-101061 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

CVE-2026-100868

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

CVE-2026-100868

Versions of Penpot prior to 2.18.0 are vulnerable to unauthenticated access via the MCP server plugin WebSocket bridge . In single-user mode, the bridge binds to all network interfaces without authentication, allowing unauthenticated attackers on adjacent networks to connect to the WebSocket port...

EUVD-2026-87940

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

CVE-2026-100868 Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

CVE-2026-100868 Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

CVE-2026-100868 Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

CVE-2026-100868: Binding to an Unrestricted IP Address

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...