CVE-2026-61550: Missing Authorization

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-63128

A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. An unauthenticated remote attacker can send specially crafted JSON-RPC POST requests to the stateful Streamable HTTP server. These requests cause the server to create and permanently retain session and channel state without prop...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Snapcast vulnerability (USN-8767-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8767-1 advisory. It was discovered that Snapcast incorrectly handled crafted JSON-RPC requests. A remote attacker could possibly use this issue to execute...

USN-8767-1: Snapcast vulnerability

It was discovered that Snapcast incorrectly handled crafted JSON-RPC requests. A remote attacker could possibly use this issue to execute arbitrary code or obtain sensitive information...

USN-8767-1 snapcast vulnerability

It was discovered that Snapcast incorrectly handled crafted JSON-RPC requests. A remote attacker could possibly use this issue to execute arbitrary code or obtain sensitive information...

EUVD-2026-76937

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-90668

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-90668

UnrealIRCd versions 6.0.5 through 6.2.6 contain a denial-of-service vulnerability in its webserver component. The server does not limit the number of HTTP request headers, allowing a remote unauthenticated attacker to send a single HTTP request with an unlimited number of headers, causing excessi...

PT-2026-90782

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-90668: Allocation of Resources Without Limits or Throttling

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-16895

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the...

CVE-2026-16895

CVE-2026-16895 is a fail-open logic vulnerability in the Metasploit Framework 's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSF_WS_JSON_RPC_API_TOKEN is not explicitly set, the internal flag msf.auth_initialize...

EUVD-2026-66836

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the...

CVE-2026-16895 Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the...

CVE-2026-16895 Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the...

CVE-2026-16895: Authentication Bypass by Primary Weakness

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the...

PT-2026-82380

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSF WS JSON RPC API TOKEN is not explicitly set, the application resets t...

CVE-2025-63080

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

CVE-2025-63080

KAON PG5298A and PG5298B routers contain an insufficient access control flaw in their JSON-RPC interface . An authenticated user on the adjacent network can send crafted JSON-RPC requests to perform operations that are otherwise restricted to the GUI, enabling system file read or command executio...

EUVD-2025-210761

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...