CVE-2026-105761: Authorization Bypass Through User-Controlled Key

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps//server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to t...

CVE-2026-88391

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

EUVD-2026-92443

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

PT-2026-105996

Name of the Vulnerable Software and Affected Versions Northstar versions prior to 9.1.2 Description The software enables the H2 Console, but the authentication interceptor only covers the /northstar/ endpoint, leaving the /h2-console endpoint exposed without authentication. Additionally, the...

CVE-2026-88391

Northstar (dromara/northstar, quantitative trading platform) versions

CVE-2026-88391

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

360solutions-bc-mcp (0.5.7), acapy-agent (>=1.6.1rc0, <=1.7.0) +197 more potentially affected by CVE-2026-102273 via pyjwt (2.13.0)

pyjwt PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - 360solutions-bc-mcp 0.5.7 - acapy-agent =1.6.1rc0, =0.1.8, =0.0.116, =1.420.5, =26.6.0, =0.25.0, =0.57.0, =0.1.0, =0.1.0, =1.1.0, =3.8.0, =3.9.3 and...

CVE-2023-32315-EXPLOIT

CVE-2023-32315 - Bypass de Autenticación en Openfire Este repositorio destaca un problema de seguridad grave que afecta a varias versiones de Openfire. Openfire, un servidor de colaboración en tiempo real multiplataforma que utiliza el protocolo XMPP desarrollado por la comunidad Ignite Realtime,...

Rocky Linux 10.2 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_18537)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202618537 advisory. tomcat: Apache Tomcat: Security constraint bypass for CGI scripts CVE-2025-46701 org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session...

Rocky Linux 9.2 [CIQ] Security Update: rubygem-io-console / rubygem-io-console-debuginfo (ciqsa-2026_1288)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261288 advisory. This advisory aggregates security fixes for the ruby SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2024-49761. Tenable has extracted the preceding description bloc...

Rocky Linux 9.4 [CIQ] Security Update: rubygem-io-console / rubygem-io-console-debuginfo (ciqsa-2026_1292)

The Rocky Linux 9.4 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261292 advisory. This advisory aggregates security fixes for the ruby SRPM in CIQ LTS 9.4. It addresses 1 CVE: CVE-2024-49761. Tenable has extracted the preceding description bloc...

360solutions-bc-mcp (>=0.5.3, <=0.5.7), acapy-agent (>=1.5.1rc0, <=1.7.0) +310 more potentially affected by CVE-2026-103001 via pyjwt (>=2.11.0, <=2.13.0)

pyjwt PYPI version =2.11.0, =0.5.3, =1.5.1rc0, =0.1.8, =0.0.116, =1.5.0a9, =0.7.0rc9, =1.405.15, =26.2.0, =4.1.102, =1.2.1, =0.0.17, =0.23.0, =0.51.0, =0.62.0 and more Source cves: CVE-2026-103001 Source advisory: MEND:CVE-2026-103001...

[SECURITY] Fedora 45 Update: gnome-console-51.0-1.fc45

Simple user-friendly terminal emulator for the GNOME desktop...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2025:1740132708)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1740132708 advisory. - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8,...

360solutions-bc-mcp (0.5.7), acapy-agent (>=1.6.1rc0, <=1.7.0) +197 more potentially affected by CVE-2026-102273 via pyjwt (2.13.0)

pyjwt PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - 360solutions-bc-mcp 0.5.7 - acapy-agent =1.6.1rc0, =0.1.8, =0.0.116, =1.420.5, =26.6.0, =0.25.0, =0.57.0, =0.1.0, =0.1.0, =1.1.0, =3.8.0, =3.9.3 and...

CVE-2026-100299

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption...

EUVD-2026-89408

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption...

CVE-2026-100299 Use of Weak Credentials in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption...

CVE-2026-100299 Use of Weak Credentials in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption...

CVE-2026-100299

Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 is vulnerable due to the inclusion of a legacy password hash on the serial console . This hash relies on weak DES-based encryption , which may allow for unauthorized access via physical means. No specific exploit information or remediation steps are...