Dataojitori vulnerabilities

Products

• nocturne_memory 1

Latest Dataojitori CVEs

Newest publication first

1. CVE-2026-44830 Empty API_TOKEN disables authentication on network-reachable HTTP/SSE transport

   Published 2026-05-27

   High·CVSS 8.7

   Nocturne Memory is a lightweight, rollbackable, and visual Long-Term Memory Server for MCP Agents. Prior to 2.4.1, when API_TOKEN is unset or empty, the BearerTokenAuthMiddleware bypasses authentication for all HTTP requests. Combined with the default 0.0.0.0 host binding and COR...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.