SUSE CVE-2025-9636

pgAdmin = 9.7 is affected by a Cross-Origin Opener Policy COOP vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation...

Malicious code in flow-security-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e80dbff81931a20f9f1099da55fe0472b8f30458e4f53f69dc6a26b5aea6a48a The OpenSSF Package Analysis project identified 'flow-security-cart' @ 99.0.2 npm as malicious. It is considered malicious because: - The packag...

MAL-2025-46923 Malicious code in flow-security-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e80dbff81931a20f9f1099da55fe0472b8f30458e4f53f69dc6a26b5aea6a48a The OpenSSF Package Analysis project identified 'flow-security-cart' @ 99.0.2 npm as malicious. It is considered malicious because: - The packag...

caption-flow (>=0.1.0, <=0.4.2), commit-bot (>=1.0.1rc1, <=1.1.8) +6 more potentially affected by CVE-2025-58446 via xgrammar (0.1.23)

xgrammar PYPI version 0.1.23 is affected by a known vulnerability. The following packages have a transitive dependency on xgrammar and may be impacted: - caption-flow =0.1.0, =1.0.1rc1, =0.0.4, =1.0.0.dev0, =0.1.1, =0.2.0, =0.9.2.post1, =0.10.0 Source cves: CVE-2025-58446 Source advisory:...

pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability

pgAdmin = 9.7 is affected by a Cross-Origin Opener Policy COOP vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation...

Origin Validation Error

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Origin Validation Error via improper enforcement of cross-origin opener policy in the OAuth authentication process. An attacker can gain unauthorized access to user accounts, escalate privileges, or...

GHSA-6859-2QXQ-FFV2 pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability

pgAdmin = 9.7 is affected by a Cross-Origin Opener Policy COOP vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation...

CVE-2025-58625

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...

CVE-2025-55162

A flaw was found in Envoy. A session management flaw was discovered in how Envoy's OAuth2 filter handles user logouts. This could allow a user's session to remain active even after they have logged out, creating a risk of account hijacking on a shared computer. Mitigation Mitigation for this issu...

CVE-2025-9636

pgAdmin = 9.7 is affected by a Cross-Origin Opener Policy COOP vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation...

CVE-2025-9636 Cross-Origin Opener Policy Vulnerability in pgAdmin 4

pgAdmin = 9.7 is affected by a Cross-Origin Opener Policy COOP vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation...

CVE-2025-9636 Cross-Origin Opener Policy Vulnerability in pgAdmin 4

pgAdmin = 9.7 is affected by a Cross-Origin Opener Policy COOP vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation...

CVE-2025-9636

CVE-2025-9636 affects pgAdmin4 (notably pgadmin4 packages in multiple Linux distributions). The vulnerability is a Cross-Origin Opener Policy (COOP) issue that could allow an attacker to manipulate the OAuth flow, potentially leading to restricted for unauthorised account access, account takeover...

GHSA-94G8-XV23-7656 Vaadin Flow Components possible file bypass via upload validation on the server-side

Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.0.m1, <=1.0.0), com.beirtipol:jfixtools-reporting (1.0-beta) +158 more potentially affected by unknown CVE via com.vaadin:vaadin-upload-flow (>=2.0.0, <=14.13.0)

com.vaadin:vaadin-upload-flow MAVEN version =2.0.0, =1.0.0.m1, =3.7.0, =2.9.3, =1.3.0, =1.0, =0.0.1, =14.0.0, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =1.0.5.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-94G8-XV23-7656...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vertx-vaadin-flow (>=23.1.0, <=23.4.1) +130 more potentially affected by unknown CVE via com.vaadin:vaadin-upload-flow (>=23.0.0, <=23.6.1)

com.vaadin:vaadin-upload-flow MAVEN version =23.0.0, =1.1.3, =23.1.0, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-94G8-XV23-7656...

ch.artaios:openchemlib-vaadin (>=1.0.0, <=2.4.1), ch.jubnl:vsecureflow (>=0.0.15, <=0.0.16) +185 more potentially affected by unknown CVE via com.vaadin:vaadin-upload-flow (>=24.0.0, <=24.7.6)

com.vaadin:vaadin-upload-flow MAVEN version =24.0.0, =1.0.0, =0.0.15, =1.1.5, =1.0.0, =24.3.0-alpha1, =24.4.0-beta1, =2.0.0-alpha1, =24.4.0-beta1, =24.4.0-beta1, =2.0.0-alpha1, =24.7.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-94G8-XV23-7656...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vertx-vaadin-flow (>=23.1.0, <=23.4.1) +130 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=23.0.0, <=23.6.1)

com.vaadin:vaadin-upload-flow MAVEN version =23.0.0, =1.1.3, =23.1.0, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: CVE-2025-9467 Source advisory:...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.0.m1, <=1.0.0), com.beirtipol:jfixtools-reporting (1.0-beta) +158 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=2.0.0, <=14.13.0)

com.vaadin:vaadin-upload-flow MAVEN version =2.0.0, =1.0.0.m1, =3.7.0, =2.9.3, =1.3.0, =1.0, =0.0.1, =14.0.0, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =1.0.5.4 and more Source cves: CVE-2025-9467 Source advisory: GHSA-94G8-XV23-7656...

ch.artaios:openchemlib-vaadin (>=1.0.0, <=2.4.1), ch.jubnl:vsecureflow (>=0.0.15, <=0.0.16) +185 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=24.0.0, <=24.7.6)

com.vaadin:vaadin-upload-flow MAVEN version =24.0.0, =1.0.0, =0.0.15, =1.1.5, =1.0.0, =24.3.0-alpha1, =24.4.0-beta1, =2.0.0-alpha1, =24.4.0-beta1, =24.4.0-beta1, =2.0.0-alpha1, =24.7.1 and more Source cves: CVE-2025-9467 Source advisory: GHSA-94G8-XV23-7656...