109 matches found
EUVD-2026-102480
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to...
CVE-2026-111322
Archon versions 0.2.13 through 0.11.1 are vulnerable to a missing authentication flaw in the /api/ control API *, which binds to 0.0.0.0 by default. An unauthenticated attacker with network access can send messages to the AI coding agent running with bypassPermissions . This allows the attacker t...
PT-2026-115280
Name of the Vulnerable Software and Affected Versions Archon versions 0.2.13 through 0.11.1 Description Missing authentication allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agen...
CVE-2022-51020 Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints
Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...
CVE-2022-51020 Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints
Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...
CVE-2022-51020
Flower versions before 2.2.0 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is that Tornado xsrf_cookies is disabled and the OAuth session cookie lacks the SameSite attribute. An attacker can trick an authenticated user into visiting a malicious page that perf...
CVE-2026-107205
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...
CVE-2026-107205
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...
CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...
EUVD-2026-94384
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...
CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...
CVE-2026-107205
Versions of LMCache through 0.5.5 are vulnerable to a missing authentication flaw in the multiprocess coordinator. The vulnerability allows remote unauthenticated attackers to access the HTTP fleet control API, which listens on all interfaces by default. Exploitation of these endpoints enables at...
CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...
CVE-2026-107205: Missing Authentication for Critical Function
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...
PT-2026-107563
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...
Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Rclone vulnerability (USN-8782-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8782-1 advisory. It was discovered that Rclone incorrectly handled unauthenticated requests to the remote...
USN-8782-1 rclone vulnerability
It was discovered that Rclone incorrectly handled unauthenticated requests to the remote control API. An attacker could possibly use this issue to execute arbitrary commands as the user invoking rclone. CVE-2026-49980...
USN-8782-1: Rclone vulnerability
It was discovered that Rclone incorrectly handled unauthenticated requests to the remote control API. An attacker could possibly use this issue to execute arbitrary commands as the user invoking rclone. CVE-2026-49980...
CVE-2026-82533
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a...
CVE-2026-82533: Reliance on Untrusted Inputs in a Security Decision
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a...