nightingale

ओपन-सोर्स अलर्टिंग विशेषज्ञ English | 中文 🎯 Nightingale क्या है Nightingale एक ओपन-सोर्स मॉनिटरिंग प्रोजेक्ट है जो अलर्टिंग पर केंद्रित है। Grafana की तरह, Nightingale भी विभिन्न मौजूदा डेटा स्रोतों से जुड़ता है। हालाँकि, जहाँ Grafana विज़ुअलाइज़ेशन पर ज़ोर देता है, वहीं Nightingale अलर्टिंग इंजन ...

CVE-2026-33032

CVE-2026-33032 / MCPwn Outil de détection non destructif pour le contournement d'authentification MCP de nginx-ui connu publiquement sous le nom de MCPwn. Permet une prise de contrôle non authentifiée en deux requêtes HTTP de toute instance nginx-ui exécutant une version vulnérable. Table des...

cve-2026-33032-scanner

Scanner CVE-2026-33032 Scanner de vulnérabilité non destructif pour le contournement d'authentification du point de terminaison MCP de Nginx-UI Présentation de la vulnérabilité CVE-2026-33032 est une vulnérabilité de contournement d'authentification dans l'intégration du Model Context Protocol MC...

CVE-2026-59822

A flaw was found in LiteLLM, a proxy server designed for Large Language Model LLM APIs. An unauthenticated attacker could exploit a vulnerability in the MCP Streamable HTTP endpoint. By using a fabricated Authorization header, the attacker could bypass the standard key validation, gaining...

siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization

CVE-2026-66012 — الاستيلاء الكامل على مدير SiYuan دون مصادقة عبر MCP إثبات المفهوم PoC للثغرة CVE-2026-66012 درجة خطورة CVSS 10.0 — حرجة، وهي ثغرة نقص التفويض Missing Authorization في نقطة نهاية MCP Model Context Protocol الخاصة بـ SiYuan، والتي تسمح لمهاجم غير مصادَق بالاستيلاء الكامل على صلاحيا...

CVE-2026-45019

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For sse and streamable-http...

CVE-2026-45019

Chainlit (a Python framework for building conversational AI applications) is affected by an SSRF vulnerability in its MCP integration. From version 2.4.0rc0 to 2.12.0 , deployments with features.mcp.enabled = true expose the POST /mcp endpoint without authentication. For SSE and streamable-http t...

EUVD-2026-42717

@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint...

PT-2026-66665

An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service DoS. The /mcp endpoint handler reads incoming payloads directly into system memory using a...

CVE-2026-66012

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

EUVD-2026-49043

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

CVE-2026-66012 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

CVE-2026-66012 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

PT-2026-64762

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2 Description A missing authorization issue exists in the 'POST /mcp' kernel endpoint, which is only protected by a general authentication check model.CheckAuth without enforcing admin roles or read-only...

EUVD-2026-42359

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback...

CVE-2026-55605 @arikusi/deepseek-mcp-server Missing Authentication on Self-Hosted HTTP MCP Endpoint

DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.8.0, the self-hosted HTTP transport of @arikusi/deepseek-mcp-server exposes POST /mcp without any authentication: createMcpExpressApp is called without an authProvider and no middleware guards t...

PT-2026-56972

Name of the Vulnerable Software and Affected Versions @arikusi/deepseek-mcp-server versions 1.4.2 through 1.7.x Description The self-hosted HTTP transport of the server exposes the POST /mcp endpoint without authentication. This occurs because the createMcpExpressApp function is called without an...

CVE-2026-58446 Presenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint

Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication AUTHUSERNAME/AUTHPASSWORD, is reachable unauthenticated at /mcp because the nginx front-end does not apply the authrequest gate to that path and the MCP server auto-mints a...

CVE-2026-58446

CVE-2026-58446 affects Presenton before 0.8.8-beta. The MCP server deployed with session authentication in server/Docker setups is reachable unauthenticated at /mcp because the nginx front-end does not apply the auth gate to that path, and the MCP server auto-mints a valid internal session token ...

GHSA-2R68-G678-7QR3 mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call

Summary The HTTP MCP JSON-RPC endpoint at /mcp requires only OAuth read scope for all requests, then dispatches tools/call directly to handlers that include mutating tools. A read-only OAuth client can call storememory and deletememory through MCP even though the corresponding REST endpoints...