23805 matches found
CVE-2026-75110 MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTHENABLED=true but the undocumented, defaultless INTERNALSERVICESECRET environment variable is unset, the isinternalrequest check in src/memos/api/middleware/auth.py fails open:...
EUVD-2026-60389
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTHENABLED=true but the undocumented, defaultless INTERNALSERVICESECRET environment variable is unset, the isinternalrequest check in src/memos/api/middleware/auth.py fails open:...
EUVD-2026-60373
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...
CVE-2025-27621
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...
CVE-2025-27621
UpTrain ≤0.7.1 ships a static default API key derived from a hardcoded username and an open CORS policy, letting any website send authenticated cross-origin requests via the uptrain-access-token header and perform privileged actions. CVSS 8.7 HIGH. No patch is available; monitor the GitHub adviso...
CVE-2025-27621 UpTrain has a Constant Default API Key
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...
CVE-2025-27621 UpTrain has a Constant Default API Key
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...
CVE-2026-74892
opensslencrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication...
PYSEC-2026-3767
opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...
PYSEC-2026-3767
opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...
CVE-2026-74882
opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...
PYSEC-2026-3744
opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...
CVE-2026-74891
The openssl_encrypt npm package (versions before 1.4.0) ships standalone server configuration files containing hardcoded, well-known default PostgreSQL credentials. Network-accessible attackers can connect to exposed PostgreSQL instances and retrieve sensitive data. No exploitation evidence is pr...
CVE-2026-74882 openssl_encrypt before 1.4.0 Insecure Default Configuration
opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...
CVE-2026-74882 openssl_encrypt before 1.4.0 Insecure Default Configuration
opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...
CVE-2026-74882 openssl_encrypt before 1.4.0 Insecure Default Configuration
opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...
CVE-2026-74882
opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...
CVE-2026-74882
openssl_encrypt versions before 1.4.0 ship with an insecure default in its IntegrityProxyConfig trusted_proxies that trusts the entire RFC 1918 private address space. This allows attackers on private networks to forge client certificate headers and bypass mTLS authentication when ProxyAuth valida...
BIT-HARBOR-2026-4404 Use of hard coded credentials in GoHarbor Harbor
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI...
