CVE-2026-23744

CVE-2026-23744: تنفيذ التعليمات البرمجية عن بُعد غير المصادق عليه في @mcpjam/inspector إخلاء مسؤولية: هذا المستودع والبرامج النصية المرتبطة به مخصصة حصريًا لتقييمات الأمان المصرح بها، واختبار الاختراق، وأبحاث الأمان، والتحليل التعليمي. الاختبار غير المصرح به للأنظمة دون موافقة كتابية صريحة غير...

CVE-2026-23744-POC

CVE-2026-23744 — MCPJam Inspector अनधिकृत RCE MCPJam Inspector -i -p -m...

CVE-2025-11953-PoC

विवरण मेट्रो डेवलपमेंट सर्वर, जो React Native Community CLI द्वारा खोला जाता है, डिफ़ॉल्ट रूप से बाहरी इंटरफेस से बंधता है। सर्वर एक एंडपॉइंट को उजागर करता है जो OS कमांड इंजेक्शन के लिए संवेदनशील है। यह अप्रमाणित नेटवर्क हमलावरों को सर्वर पर POST अनुरोध भेजने और मनमाने एक्ज़ीक्यूटेबल्स चलाने की...

CVE-2026-9680

The CVE concerns alibabacloud-rds-openapi-mcp-server where an MCP endpoint bound to all network interfaces by default exposes MCP tools. Root cause: improper exposure caused by insecure default binding. Impact: remote attackers can access exposed MCP tools via network without authentication? The ...

CVE-2026-9680 MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default...

PYSEC-2026-3517 PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

Unauthenticated PraisonAI UI MCP connect endpoint executes attacker-chosen local commands Summary PraisonAI v4.6.48 exposes the PraisonAIUI MCP client management API through the default UI host apps without authentication. A remote unauthenticated client can send POST /api/mcp/connect with a...

CVE-2026-45077

CVE-2026-45077 concerns Symfony’s server:log listener (part of Symfony\Bridge\Monolog) which binds to 0.0.0.0:9911 by default and processes each frame with unserialize(base64_decode($message)) without authentication or an allowed-classes allowlist. This permits any reachable host to submit attack...

GO-2026-5401 Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon

Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon...

PT-2026-61657

Name of the Vulnerable Software and Affected Versions Network-AI versions 5.0.0 through 5.12.1 Description The ApprovalInbox feature, located in lib/approval-inbox.ts, serves as the network interface for the human-in-the-loop Approval Gate used to authorize high-risk operations. The associated HT...

CVE-2026-46430

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort"", ":5553" resolves to ":5553"...

CVE-2026-46430

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort"", ":5553" resolves to ":5553"...

CVE-2026-46430 Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort"", ":5553" resolves to ":5553"...

EUVD-2026-31869

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort"", ":5553" resolves to ":5553"...

Exploit for Missing Authentication for Critical Function in Mcpjam Inspector

exploit-CVE-2026-23744 MCPJam Inspector is a local-first devel...

Red Hat Keycloak 授权问题漏洞

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that stems from the default ECP binding flow that allows bypassing other authentication...