CVE-2026-23744-Lab

CVE-2026-23744 – Laboratorio Docker de MCPJam Inspector Este repositorio es un pequeño laboratorio Docker para comparar una compilación vulnerable frente a una parcheada de MCPJam Inspector para CVE-2026-23744. Está pensado para aprender y para construir un portafolio público de seguridad:...

exploit-CVE-2026-23744

exploit-CVE-2026-23744 MCPJam Inspector es una plataforma de desarrollo local-first para servidores MCP. En las versiones 1.4.2 y anteriores, una vulnerabilidad de ejecución remota de código permite a los atacantes enviar solicitudes HTTP manipuladas que instalan un servidor MCP y ejecutan código...

CVE-2026-38924

In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...

UnboundID LDAP Server Administrative Credential Exposure

Spring Security is vulnerable to an UnboundID LDAP Server Administrative Credential Exposure. The vulnerability is due to the embedded UnboundID LDAP server UnboundIdContainer unconditionally registering an administrative credential and binding its listener to all available network interfaces,...

CVE-2026-82456

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

CVE-2026-81094

CVE-2026-81094 affects the mcp-router CLI (prior to version 0.6.3). The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port and enforced authentication only when an explicit token flag was supplied. A default invocation therefore expose...

CVE-2026-81094 mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding...

CVE-2026-59270

Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18...

CVE-2026-59270

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers a well-known administrative bind DN and binds its listener to all available network interfaces , exposing the credential to any network-reachable host. This affects Spring Security 5.7.0 through 7.1.0 ...

CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

Summary IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server component spanning three...

CVE-2026-54772

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that can reach a NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoint can trigger premature EOF handling in the CoreWCF...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following through the WriteToCachedFile function when handling network cache files in certain configurations. An attacker can overwrite specific host files and change their ownership by planting a symbolic lin...

GO-2026-4967 NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access in github.com/orneryd/nornicdb

NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access in github.com/orneryd/nornicdb...

PT-2026-42371

NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access in github.com/orneryd/nornicdb...

CVE-2026-0481

Unrestricted IP address binding in the AMD Device Metrics Exporter ROCm ecosystem could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability...

CVE-2026-42072 Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access

Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag and NORNICDBADDRESS / server.host config key is plumbed through to the HTTP server correctly but never reaches the Bo...

CVE-2026-42072 Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access

Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag and NORNICDBADDRESS / server.host config key is plumbed through to the HTTP server correctly but never reaches the Bo...

CVE-2026-42072

NornicDB suffers an improper network binding in the Bolt server: the Bolt listener binds to all interfaces because Bolt’s config lacked a host field, so using --address defaults to an empty host. This causes exposure of the Bolt port (default admin:password) on the LAN, enabling unauthorized remo...