4144 matches found
aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2026-54277 via aiohttp (1.1.5)
aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...
aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2026-54276 via aiohttp (1.1.5)
aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...
aiobotocore (0.2.3), aiobotocore-botorange (>=0.1.0, <=0.2.3a0) +9 more potentially affected by CVE-2026-54276 via aiohttp (1.3.5)
aiohttp PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiobotocore 0.2.3 - aiobotocore-botorange =0.1.0, =0.0.3a0, =1.2.0, =1.0.0, =3.0.2, =3.0.5 Source cves: CVE-2026-54276 Source advisory:...
devtools-proxy (>=0.0.2, <=0.0.3) potentially affected by CVE-2026-54276 via aiohttp (1.1.4)
aiohttp PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - devtools-proxy =0.0.2, =0.0.3 Source cves: CVE-2026-54276 Source advisory: OSV:GHSA-HPJ7-WQ8M-9HGP...
botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2026-54276 via aiohttp (1.1.6)
aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2026-54276 Source advisory: OSV:GHSA-HPJ7-WQ8M-9HGP...
botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2026-54279 via aiohttp (1.1.6)
aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2026-54279 Source advisory: OSV:GHSA-2FQR-MR3J-6WP8...
aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2026-54279 via aiohttp (1.1.5)
aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...
aiobotocore (0.2.3), aiobotocore-botorange (>=0.1.0, <=0.2.3a0) +9 more potentially affected by CVE-2026-54279 via aiohttp (1.3.5)
aiohttp PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiobotocore 0.2.3 - aiobotocore-botorange =0.1.0, =0.0.3a0, =1.2.0, =1.0.0, =3.0.2, =3.0.5 Source cves: CVE-2026-54279 Source advisory:...
devtools-proxy (>=0.0.2, <=0.0.3) potentially affected by CVE-2026-54279 via aiohttp (1.1.4)
aiohttp PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - devtools-proxy =0.0.2, =0.0.3 Source cves: CVE-2026-54279 Source advisory: OSV:GHSA-2FQR-MR3J-6WP8...
aiobotocore (0.2.3), aiobotocore-botorange (>=0.1.0, <=0.2.3a0) +9 more potentially affected by CVE-2026-50269 via aiohttp (1.3.5)
aiohttp PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiobotocore 0.2.3 - aiobotocore-botorange =0.1.0, =0.0.3a0, =1.2.0, =1.0.0, =3.0.2, =3.0.5 Source cves: CVE-2026-50269 Source advisory:...
devtools-proxy (>=0.0.2, <=0.0.3) potentially affected by CVE-2026-50269 via aiohttp (1.1.4)
aiohttp PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - devtools-proxy =0.0.2, =0.0.3 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...
aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2026-50269 via aiohttp (1.1.5)
aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...
botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2026-50269 via aiohttp (1.1.6)
aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2026-50269 Source advisory: OSV:GHSA-M6QW-4CW2-HM4M...
NPM: Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
NPM: Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE vulnerability discovered by ? in WordPress Npm vite-plus versions = 0.1.23...
Missing Authorization
Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Missing Authorization in the cdp API exposed by the browser WebSocket RPC, which allows forwarding of raw Chrome DevTools Protocol methods without proper enforcement of write and exec...
Missing Authorization
Overview vitest is a Next generation testing framework powered by Vite Affected versions of this package are vulnerable to Missing Authorization in the cdp API exposed by the browser WebSocket RPC, which allows forwarding of raw Chrome DevTools Protocol methods without proper enforcement of write...
Missing Authorization
Overview @vitest/browser-playwright is a Browser running for Vitest using playwright Affected versions of this package are vulnerable to Missing Authorization in the cdp API exposed by the browser WebSocket RPC, which allows forwarding of raw Chrome DevTools Protocol methods without proper...
Missing Authorization
Overview @vitest/coverage-v8 is a V8 coverage provider for Vitest Affected versions of this package are vulnerable to Missing Authorization in the cdp API exposed by the browser WebSocket RPC, which allows forwarding of raw Chrome DevTools Protocol methods without proper enforcement of write and...
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Summary Vitest Browser Mode exposes a cdp API that forwards raw Chrome DevTools Protocol CDP methods over the Vitest browser WebSocket RPC. CDP is not gated by browser.api.allowWrite, browser.api.allowExec, api.allowWrite, or api.allowExec. As a result, disabling Browser Mode write and exec...
GHSA-G8MR-85JM-7XHM Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Summary Vitest Browser Mode exposes a cdp API that forwards raw Chrome DevTools Protocol CDP methods over the Vitest browser WebSocket RPC. CDP is not gated by browser.api.allowWrite, browser.api.allowExec, api.allowWrite, or api.allowExec. As a result, disabling Browser Mode write and exec...