CVE-2026-61427

PraisonAI before 4.6.78 has an authentication bypass in the MCP HTTP-stream transport: running with --transport http-stream and no API key allows unauthenticated clients to initialize sessions, enumerate tools (tools/list), and invoke tools (tools/call). The dispatcher forwards tool-call argument...

CVE-2026-61427

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream'...

CVE-2026-61427 PraisonAI before 4.6.78 Authentication Bypass via HTTP-stream

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream'...

EUVD-2026-44626

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth a non-default configuration. In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented,...

CVE-2026-56353

The CVE-2026-56353 issue affects n8n’s Chat Trigger node configured with n8n User Auth. Affected releases permit bypassing the authentication check on the Chat Trigger webhook endpoint, enabling access without valid credentials. Vulnerable versions include prior to 1.123.22, the 2.0.0–2.9.2 line,...

CVE-2026-56353

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth a non-default configuration. In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented,...

CVE-2026-56353 n8n - Authentication Bypass in Chat Trigger Node

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth a non-default configuration. In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented,...

CVE-2026-56353 n8n - Authentication Bypass in Chat Trigger Node

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth a non-default configuration. In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented,...

Authentication Bypass

9Router is vulnerable to Authentication Bypass. The vulnerability is due to improper trust of loopback requests, where requests forwarded through 127.0.0.1 are incorrectly treated as local and exempt from API key authentication, allowing unauthenticated attackers to access protected /v1 APIs and...

CVE-2026-12281

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach...

SUSE CVE-2026-58253

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

[SECURITY] [DLA 4683-1] wolfssl security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-4683-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta July 15, 2026 https://wiki.debian.org/LTS - -----------------------------------------------------------------------...

Oracle Linux 10 : tomcat (ELSA-2026-19054)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19054 advisory. - Resolves: RHEL-150719 Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: RHEL-124493 tomcat: Directory...

PT-2026-60193

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.4 Description An authentication bypass occurs when the software is deployed with LIGHTRAG API KEY configured but AUTH ACCOUNTS is not set. This happens because the lightrag/api/auth.py file reverts to a hardcoded...

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

Adobe Experience Manager 6.5.0 < 6.5.2 / 2026.5.0 < 2026.6.0 Multiple Vulnerabilities (APSB26-74)

The version of Adobe Experience Manager installed on the remote host is prior to 2026.6.0, 6.5.2. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-74 advisory. - Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Director...

The vulnerability of the libcurl library in software applications for interacting with servers via cURL allows a hacker to gain unauthorized access to protected information.

The vulnerability of the libcurl library in software applications for interacting with servers via cURL is related to the possibility of bypassing the authentication process. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected informatio...

NVIDIA Triton Inference Server Authorization Issue Vulnerability

NVIDIA Triton Inference Server is an open-source AI model inference service system developed by NVIDIA Corporation in the United States. There is an authorization issue vulnerability in NVIDIA Triton Inference Server. This vulnerability stems from the existence of alternative paths or channels,...

PT-2026-60342

Name of the Vulnerable Software and Affected Versions Autel MaxiCharger AC Elite Home affected versions not specified Description An authentication bypass exists in the exposed USB interface of the device. This flaw allows a physically present attacker to access system functionality without...

PT-2026-60407

Name of the Vulnerable Software and Affected Versions SAML Single Sign On – SSO Login plugin for WordPress versions prior to 5.4.4 Description An authentication bypass exists due to SAML Signature Algorithm Confusion. The issue occurs because the Mo SAML Utilities::mo saml cast key function reads...