CVE-2026-81664

OpenFaaS gateway versions 0.27.11 through 0.27.13 contain a missing authentication flaw on the GET /system/telemetry route. The TelemetryHandler was omitted from the auth.DecorateWithBasicAuth wrap block, so when basic_auth is enabled the route still forwards requests to the provider without a cr...

EUVD-2026-67033

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basicauth is enabled, wraps each administrative /system/ handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added i...

CVE-2026-81098 Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

CVE-2026-81098 Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

CVE-2026-81098 Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

CVE-2026-81098

The Telnyx MCP server (telnyx-node package through 6.83.0 ) exposed its Streamable HTTP transport on all network interfaces without requiring caller credentials. The vulnerable component, packages/mcp-server/src/http.ts, bound its listener to every interface and parsed authentication headers in a...

EUVD-2026-67022

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding...

CVE-2026-81094 mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding...

CVE-2026-81094 mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding...

CVE-2026-80208 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxi...

CVE-2024-3094

CVE-2024-3094 CVE-2024-3094 ha esposto una backdoor nella libreria di compressione XZ, consentendo l'accesso SSH remoto eludendo l'autenticazione. Si tratta di un grave attacco alla supply chain che colpisce i sistemi Linux, evidenziando i rischi nei componenti open source fidati. La backdoor XZ:...

CVE-2026-80207 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the...

CVE-2026-80207 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the...

CVE-2026-80207

APITable through 1.13.0-beta.1 is affected by a missing authentication flaw on the Internal Notify Controller create handler. The endpoint is annotated with requiredLogin = false, and the ResourceInterceptor returns before any session or API-key validation. Because the shipped nginx gateway proxi...

CVE-2021-34646

CVE-2021-34646 PoC Diese Schwachstellen-Details von NVD Versionen bis einschließlich 5.4.3 des WordPress-Plugins Booster for WooCommerce sind anfällig für einen Authentifizierungs-Bypass über die Funktion processemailverification. Ursache ist eine Schwachstelle bei der Zufallstoken-Generierung in...

CVE-2024-21413

CVE-2024-21413 Dieses Python-Skript dient dazu, die CVE-2024-21413 auszunutzen, die als „MonikerLink“ bezeichnet wird. TryHackMe-Raum: MonikerLink Annahmen Dieser PoC wurde für eine Laborumgebung erstellt, was bedeutet, dass der Server in einer bestimmten Konfiguration eingerichtet sein muss d. h...

CVE-2020-26061

CVE-2020-26061 Bypass dell'autenticazione del portale di reimpostazione password di ClickStudios Passwordstate Informazioni Fornitore: ClickStudios Prodotto: Passwordstate Versioni interessate: Prima della build 8501 della versione 8.5 Ricercatore: Jason Juntunen aka @missing0x00...

CVE-2018-0296

CVE-2018-0296 Testa CVE-2018-0296 ed estrae i nomi utente da Cisco ASA. Per maggiori dettagli tecnici, consulta https://sekurak.pl/opis-bledu-cve-2018-0296-ominiecie-uwierzytelnienia-w-webinterfejsie-cisco-asa/. Menu di aiuto root@kitploit: $ ./CVE-2018-0296 -h Opzioni: -h, --help mostra le...

CVE-2013-6117

CVE-2013-6117 root@kitploit: $ ./CVE-2013-6117 -h Options: -h, --help display help information -f, --filename File containing list of IP addresses -t, --target Target IP -n, --threads No of concurrent threads default: 100 root@kitploit: $ ./CVE-2013-6117 -f hostfile.txt...

cve-2018-11714_POC

cve-2018-11714POC Um problema foi descoberto no TP-Link TL-WR840N. Esse problema é causado pelo manuseio incorreto de sessão na pasta /cgi/ ou em um arquivo /cgi. Se um atacante enviar um cabeçalho "Referer: http://192.168.0.1/mainFrame.htm", nenhuma autenticação será necessária para qualquer açã...