7392 matches found
EUVD-2026-96922
Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts int...
CVE-2026-108749 docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...
CVE-2026-108749
A missing authentication vulnerability in docling-serve versions 1.14.0 through 1.36.0 allows unauthenticated remote attackers to access the /v1/memory/stats and /v1/memory/counts endpoints. The root cause is the omission of the require_auth dependency, enabling attackers to bypass the DOCLING_SE...
CVE-2026-108749
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...
EUVD-2026-96914
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...
CVE-2026-108757: Missing Authentication for Critical Function
Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts int...
CVE-2026-108749: Undefined Security Weakness
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
PT-2026-110182
šØ CVE-2026-108863 Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /config dump endpoint to read configured...
CVE-2026-108863: Missing Authentication for Critical Function
Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /configdump endpoint to read configured LLM provider API...
CVE-2026-108549
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhooksecret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an...
CVE-2026-108549 cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhooksecret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an...
EUVD-2026-96344
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhooksecret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an...
CVE-2026-108549
The software cc-connect through version 1.5.0 is vulnerable to a missing authentication flaw in the MAX platform adapter webhook mode (specifically in platform/max/max.go). If no webhook_secret is configured, the application accepts unauthenticated updates. A remote attacker capable of reaching t...
CVE-2026-108549 cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhooksecret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an...
CVE-2026-103889
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...
CVE-2026-108549: Missing Authentication for Critical Function
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhooksecret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an...
PT-2026-109664
Name of the Vulnerable Software and Affected Versions cc-connect versions prior to 1.5.1 Description The MAX platform adapter webhook mode in platform/max/max.go fails to require authentication when no webhook secret is configured. Remote attackers can access the webhook listener on port 8080 and...
PT-2026-109482
Name of the Vulnerable Software and Affected Versions 3D Product configurator for WooCommerce versions prior to 2.16.3 Description Remote Code Execution is possible due to missing authentication and nonce checks on the wp loaded handler. The issue occurs because the xpv image POST parameter is no...
CVE-2026-103889: Unrestricted Upload of File with Dangerous Type
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...