81 matches found
nightingale
开源监控告警管理专家 English | 中文 夜莺是什么 夜莺 Nightingale 是一款开源云原生监控告警工具，是中国计算机学会接受捐赠并托管的第一个开源项目，在 GitHub 上有超过 12000 颗星，广受关注和使用。夜莺的统一告警引擎，可以对接 Prometheus、Elasticsearch、ClickHouse、Loki、MySQL 等多种数据源，提供全面的告警判定、丰富的事件处理和灵活的告警分发及通知能力。 夜莺侧重于监控告警，类似于 Grafana 的数据源集成方式，夜莺也是对接多种既有的数据源，不过 Grafana...
CVE-2026-33032
CVE-2026-33032 / MCPwn Herramienta de detección no destructiva para la omisión de autenticación MCP de nginx-ui conocida públicamente como MCPwn. Permite la toma de control no autenticada de cualquier instancia de nginx-ui que ejecute una versión vulnerable mediante dos peticiones HTTP. Tabla de...
cve-2026-33032-scanner
Escáner CVE-2026-33032 Escáner de vulnerabilidades no destructivo para la omisión de autenticación del endpoint MCP de Nginx-UI Resumen de la Vulnerabilidad CVE-2026-33032 es una vulnerabilidad de omisión de autenticación en la integración del Protocolo de Contexto de Modelo MCP de nginx-ui. El...
siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization
CVE-2026-66012 — SiYuan MCP Unauthenticated Administrator Takeover Proof of Concept for CVE-2026-66012 CVSS 10.0 Critical, a missing-authorization vulnerability in SiYuan's MCP Model Context Protocol endpoint that allows an unauthenticated attacker to achieve administrator takeover and remote cod...
CVE-2026-77254 MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller c...
EUVD-2026-84743
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller c...
CVE-2026-77254 MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller c...
CVE-2026-77254: Missing Authentication for Critical Function
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller c...
CVE-2026-77519
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the ispermanent and expiretime checks used by the standard chat API. A previously valid,...
CVE-2026-61568
@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preservin...
EUVD-2026-79999
@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preservin...
PT-2026-91938
Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password...
CVE-2026-61568: Reliance on Reverse DNS Resolution for a Security-Critical Action
@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preservin...
Security Bulletin: Langflow is vulnerable to authentication bypass and insufficient session expiration
Summary Langflow provides API key-based authentication for programmatic access to flow execution and MCP endpoints. The MCP HTTP API credential resolvers do not apply the same AUTOLOGIN API-key guard that all standard authenticated endpoints enforce; when Langflow is in its default AUTOLOGIN...
CVE-2026-59822
A flaw was found in LiteLLM, a proxy server designed for Large Language Model LLM APIs. An unauthenticated attacker could exploit a vulnerability in the MCP Streamable HTTP endpoint. By using a fabricated Authorization header, the attacker could bypass the standard key validation, gaining...
CVE-2026-45018
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...
CVE-2026-45019
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For sse and streamable-http...
Server-side Request Forgery (SSRF)
Overview chainlit is a Build Conversational AI. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /mcp connect handling in backend/chainlit/server.py. An attacker can force the server to make outbound HTTP requests to arbitrary internal or external URLs ...
CVE-2026-45019
Chainlit (a Python framework for building conversational AI applications) is affected by an SSRF vulnerability in its MCP integration. From version 2.4.0rc0 to 2.12.0 , deployments with features.mcp.enabled = true expose the POST /mcp endpoint without authentication. For SSE and streamable-http t...