25164 matches found
PT-2026-28963
Уязвимость компонента Base браузеров Google Chrome и Microsoft Edge связана с возможностью использования памяти после освобождения. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании с помощью специально созданной HTML-страницы...
Missing Authentication for Critical Function
Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the POST /api/v1/buildpublictmp/flowid/flow endpoint when attacker-controlled flow data is supplied to the data parameter, which is then executed using exec without authentication or...
langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-33017 via langflow-base (0.7.2)
langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-33017 Source advisory: SNYK:PYTHON-LANGFLOWBASE-15680351...
CVE-2025-69196
A flaw was found in FastMCP, a framework for building MCP applications. The server does not correctly process the resource parameter provided by the client during authorization and token requests. This can lead to security tokens being issued for an unintended base URL Uniform Resource Locator...
Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
Apache Airflow versions 3.1.0 through 3.1.7 session token token in cookies is set to path=/ regardless of the configured webserver baseurl or api baseurl. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full...
GHSA-4FHM-P86V-HWPX Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
Apache Airflow versions 3.1.0 through 3.1.7 session token token in cookies is set to path=/ regardless of the configured webserver baseurl or api baseurl. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full...
PYSEC-2026-16
Apache Airflow versions 3.1.0 through 3.1.7 session token token in cookies is set to path=/ regardless of the configured webserver baseurl or api baseurl. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full...
CVE-2026-28779 Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
Apache Airflow versions 3.1.0 through 3.1.7 session token token in cookies is set to path=/ regardless of the configured webserver baseurl or api baseurl. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full...
CVE-2026-28779 Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
Apache Airflow versions 3.1.0 through 3.1.7 session token token in cookies is set to path=/ regardless of the configured webserver baseurl or api baseurl. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full...
CVE-2026-28779 Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
Apache Airflow versions 3.1.0 through 3.1.7 session token token in cookies is set to path=/ regardless of the configured webserver baseurl or api baseurl. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full...
CVE-2026-28779
Apache Airflow versions 3.1.0 through 3.1.7 are vulnerable to a session hijacking flaw because the session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url . This misconfiguration allows any application co-hosted under the same domain ...
CVE-2026-4276
creationtimestamp| type| source ---|---|--- 2026-03-17 03:00:09+00:00| seen| https://kb.cert.org/vuls/id/624941 2026-03-18 23:07:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhem37zmxp25...
RHEL 9 : redhat-ds:12 (RHSA-2026:4661)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:4661 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol LDAP serve...
DSA-6167-1 gst-plugins-base1.0 - security update
Bulletin has no description...
CVE-2025-69196
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for...
CVE-2025-69196 FastMCP OAuth Proxy token reuse across MCP servers
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for...
CVE-2025-69196 FastMCP OAuth Proxy token reuse across MCP servers
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for...
CVE-2025-69196 FastMCP OAuth Proxy token reuse across MCP servers
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for...
CVE-2025-69196
The GHSA advisory GHSA-5H2M-4Q8J-PQPJ describes a misconfiguration in FastMCP OAuth Proxy where the token issuer/audience are derived from the proxy’s base_url, causing access and refresh tokens to be issued without binding to the requested MCP server resource. This means tokens can be used on ot...
PSF-2026-11
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update, |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.jsoutput lacked the output validation applie...