GO-2026-6703 Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs in github.com/0xJacky/Nginx-UI

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs in github.com/0xJacky/Nginx-UI...

CVE-2026-110207 Wukong AICRM through 20260610 Missing Authorization in User and Role Management APIs

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin...

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named token and the AuthRequired middleware accepts that cookie as an authentication source. Because management endpoints are protected by AuthRequired and do not enforce a universal CSRF token or Origin/Referer check, a remote attack...

GHSA-33RR-WQ23-G6GG Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named token and the AuthRequired middleware accepts that cookie as an authentication source. Because management endpoints are protected by AuthRequired and do not enforce a universal CSRF token or Origin/Referer check, a remote attack...

CVE-2026-107809 Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

CVE-2026-107809

Nginx UI , a web interface for the Nginx web server, is vulnerable to Cross-Site Request Forgery (CSRF) in versions 2.0.0 through 2.5.0 . The root cause is that the AuthRequired mechanism accepts a browser-managed token cookie as an API credential after the front end stores a JWT in that cookie. ...

CVE-2026-107809 Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

CVE-2026-107809 Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

CVE-2026-55494

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

CVE-2026-55494

The Tugtainer application (prior to version 1.30.4 ) is vulnerable to unauthenticated access to Docker management APIs because the agent/auth.py signature verification function incorrectly returns successfully when Config.AGENT_SECRET is empty. This flaw allows attackers to bypass authentication ...

CVE-2026-55494 Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

CVE-2026-55494 Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

EUVD-2026-90193

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

CVE-2026-55494 Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

CVE-2026-55494: Improper Access Control

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

PT-2026-103470

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT SECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

GO-2026-6362 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs in github.com/openchoreo/openchoreo

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs in github.com/openchoreo/openchoreo...

GHSA-QH9R-J7RP-4X2M OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

Summary The OpenChoreo control-plane cluster-gateway served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the...

CVE-2026-54693

ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/userv2email.go, internal/command/userv2phone.go, and internal/command/userv2human.go allowed...

Important: Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.6.12

Assisted installer RHEL 9 components for the multicluster engine for Kubernetes 2.6.12 General Availability release, with updates to container images. Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.6.12 release that simplify the process of...