https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T22:17:07.851651+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-336988 EUVD-2026-336988 2026-10-09T22:17:07.925607+00:00 EUVD-2026-336988 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58446 fkie_cve-2026-58446 2026-10-09T22:17:07.925652+00:00

Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is reachable unauthenticated at /mcp because the nginx front-end does not apply the auth_request gate to that path and the MCP server auto-mints a valid internal session token for the configured user. A remote unauthenticated attacker can invoke MCP tools such as generate_presentation, performing authenticated application actions, consuming the operators configured LLM API keys, and creating presentations in the operators instance. The Electron desktop build is not affected (MCP disabled).

 https://cve.radiocsirt.org/vuln/ghsa-j446-h28c-8p3v GHSA-j446-h28c-8p3v 2026-10-09T22:17:07.925691+00:00

Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is reachable unauthenticated at /mcp because the nginx front-end does not apply the auth_request gate to that path and the MCP server auto-mints a valid internal session token for the configured user. A remote unauthenticated attacker can invoke MCP tools such as generate_presentation, performing authenticated application actions, consuming the operators configured LLM API keys, and creating presentations in the operators instance. The Electron desktop build is not affected (MCP disabled).