837 matches found
EUVD-2026-82591
Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...
CVE-2026-87701
Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...
CVE-2026-87701
Azure Cosmos DB is affected by an injection vulnerability (improper neutralization of special elements in output used by a downstream component) that allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 9.6 (CRITICAL) , with a vector of AV:N/AC:L/PR:L/UI:N/S:...
Azure Cosmos DB Elevation of Privilege Vulnerability
Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...
CVE-2026-87701: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...
CVE-2026-49446
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...
CVE-2026-49446 Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...
EUVD-2026-78588
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...
CVE-2026-49446 Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...
CVE-2026-49446 Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...
CVE-2026-49446
Cosmos-Server (a self-hosted secure gateway and server manager by azukaar ) is vulnerable to authentication bypass via forward-auth header smuggling on its Constellation tunnel in versions prior to 0.22.19 . The tokenMiddleware in src/proxy/routerGen.go returns through the Constellation bypass br...
CVE-2026-49446: Improper Authorization
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...
The vulnerability of the Azure Cosmos DB database management system, related to bypassing authentication using a user-controlled key, allows attackers to perform spear-phishing attacks.
The vulnerability of the Azure Cosmos DB database management system is related to the ability to bypass authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to perform brute-force attacks remotely...
Azure Cosmos DB Spoofing Vulnerability
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...
SUSE CVE-2026-49447
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...
EUVD-2026-70796
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...
CVE-2026-69857
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...
CVE-2026-69857
Azure Cosmos DB is affected by an authorization bypass through user-controlled key , allowing an authorized attacker to perform spoofing over a network. The vulnerability is rated CVSS 3.1: 8.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a changed scope and hi...