CVE-2026-22812

🔐 CVE-2026-22812 - OpenCode 인증되지 않은 HTTP 서버 → 원격 코드 실행 RCE CVE-2026-22812에 대한 보안 권고, 기술 분석, 탐지 지침 및 완화 노트 📌 개요 CVE-2026-22812 는 1.0.216 이전의 OpenCode 버전에 영향을 미치는 고심각도 원격 코드 실행 RCE 취약점입니다. 문제는 OpenCode가 자동으로 인증되지 않은 로컬 HTTP 서버 를 시작하며, 이 서버에 다음을 통해 액세스할 수 있다는 점에 있습니다: 로컬 악성 프로세스 허용적인 CORS를 통한 브라우저 탭...

CVE-2026-77884

Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage...

CVE-2026-77884 Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure

Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage...

CVE-2026-77884 Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure

Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage...

EUVD-2026-77755

Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage...

CVE-2026-77884

Gallery – Private Photo Vault v1.0.41 (Android) starts an unauthenticated HTTP server on TCP port 8080 reachable from the adjacent network. The server exposes files and directory listings from Android external storage , allowing any device on the same local network to read private photo data with...

PT-2026-91397

Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage...

CVE-2026-34045

Podman Desktop is a graphical tool for developing on containers and Kubernetes. Prior to 1.26.2, an unauthenticated HTTP server exposed by Podman Desktop allows any network attacker to remotely trigger denial-of-service conditions and extract sensitive information. By abusing missing connection...

CVE-2026-22812: Missing Authentication for Critical Function

OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process or any website via permissive CORS to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216...

PT-2026-2315

Name of the Vulnerable Software and Affected Versions OpenCode versions prior to 1.0.216 Description OpenCode, an open source AI coding agent, has an issue where it automatically starts an unauthenticated HTTP server. This allows any local process, or any website due to permissive CORS settings, ...