CVE-2026-53497 CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...

CVE-2026-53497 CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...

CVE-2026-53497 CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...

CVE-2026-73537

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

CVE-2026-73537

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

EUVD-2026-63826

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

CVE-2026-73537

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

CVE-2026-73537

CVE-2026-73537 is a cross-site scripting (CWE-79) vulnerability in the Miraikan Assist App provided by the Japan Science and Technology Agency (JST) . The flaw allows an arbitrary script to be executed in the app's WebView browser component, potentially altering displayed content. The vulnerabili...

Miraikan Assist App vulnerable to cross-site scripting

Overview Miraikan Assist App provided by Japan Science and Technology Agency JST contains the following vulnerability. Cross-site scripting CWE-79 - CVE-2026-73537 RyotaK of GMO Flatt Security Inc. reported this vulnerability to the developer and coordinated. After the coordination was completed,...

CVE-2026-20679

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Processing a maliciously crafted file may lead to unexpected app termination...

SUSE CVE-2026-43804

This issue was addressed through improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. Visiting a website may lead to an app denial-of-service...

CVE-2026-20679

The CoreUI component in macOS is vulnerable to a flaw where processing a maliciously crafted file can lead to unexpected app termination . This issue was addressed by Apple with improved checks . The vulnerability is fixed in macOS Sequoia 15.7.5 , macOS Sonoma 14.8.5 , and macOS Tahoe 26.4 . Exp...

CVE-2026-20679

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Processing a maliciously crafted file may lead to unexpected app termination...

CVE-2026-20679

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Processing a maliciously crafted file may lead to unexpected app termination...

PT-2026-79311

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

CVE-2026-53497: Exposure of Sensitive Information to an Unauthorized Actor

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...

PT-2026-79271

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Processing a maliciously crafted file may lead to unexpected app termination...

CVE-2026-73537: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

CVE-2026-20679: Out-of-bounds Read

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Processing a maliciously crafted file may lead to unexpected app termination...

PT-2026-79483

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other sessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...