CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control due to a flaw in the JiMuMDCCommonsRequestLoggingFilter.java component. The application improperly uses the userid from the request header as the primary mechanism for identity verification. This allows an attacker to forge user identity cr...

EUVD-2026-66748

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

CVE-2026-49332

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...

Malicious code in @bonsai-ai/claude-code (npm)

Source: amazon-inspector ad3b5646cf88b8eb5a7dbbec9fc2f1cfefcdf3a241d9604992e72c2f629889b9 Package published as @bonsai-ai/claude-code impersonates Anthropic's official @anthropic-ai/claude-code CLI. package.json sets author to 'Anthropic ' and homepage to https://github.com/anthropics/claude-code...

GHSA-3QG8-HQ7J-JJ33 Duplicate Advisory: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rggc-m335-3wvj. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to...

CVE-2026-53832 OpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration

OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attackers with access to the proxy-facing Gateway port can supply forged identity headers to assume operator identity and potentially escalate...

OpenClaw Identity Forgery Vulnerability

OpenClaw is an open source framework for Telegram bot rights management. OpenClaw suffers from an identity forgery vulnerability. An attacker can exploit this vulnerability to illegally manipulate bots by recycling usernames to disguise their identities and bypass privilege restrictions...

OpenClaw security vulnerabilities

OpenClaw is an open source framework for Telegram bot rights management. OpenClaw suffers from an identity forgery vulnerability. An attacker can exploit this vulnerability to illegally manipulate bots by recycling usernames to disguise their identities and bypass privilege restrictions...

OpenAM injection vulnerability

OpenAM is an all-in-one access management solution organized by the OpenAM Consortium. It provides authentication, authorization, delegation, and federation capabilities. An injection vulnerability exists in Open Access Management OpenAM versions prior to 16.0.0 that stems from the...

EUVD-2025-5064

Malicious code in bioql PyPI...

SICK Field Analytics and SICK Media Server have vulnerabilities related to encryption issues.

SICK Field Analytics and SICK Media Server are both products of SICK GmbH, Germany.SICK Field Analytics is software for evaluating manufacturing data.SICK Media Server is a media server. A security vulnerability exists in SICK Field Analytics and SICK Media Server that stems from support for an...

Fortinet FortiOS security vulnerabilities

Fortinet FortiOS is a set of security operating systems dedicated to the FortiGate network security platform from the U.S. company Fiat Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. Fortinet FortiOS...

asterisk security vulnerabilities

Asterisk is an Asterisk open source software for PBX systems that runs on Linux and supports IP calls using SIP, IAX, and H323 protocols. Asterisk has a security vulnerability that stems from improper authentication of SIP MESSAGE requests, which could lead to identity forgery and spamming...

CVE-2024-36555

Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36YDRA3PWGM7SV1.02019071516.19.24cobh and Forever KidsWatch Call Me 2 KW-60 R36CWYDES4A292V1.02023.05.2422.49.44cobb allows malicious users to change the device IMEI-number which allows for forging the identity of the device...

CVE-2024-36555

Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36YDRA3PWGM7SV1.02019071516.19.24cobh and Forever KidsWatch Call Me 2 KW-60 R36CWYDES4A292V1.02023.05.2422.49.44cobb allows malicious users to change the device IMEI-number which allows for forging the identity of the device...

CVE-2024-36555

The Forever KidsWatch Call Me KW50 (version R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h) and Forever KidsWatch Call Me 2 KW-60 (version R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b) are vulnerable to a security flaw involving unverified privileges on built-in SMS-configuration commands....

CVE-2024-36555: Missing Authentication for Critical Function

Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36YDRA3PWGM7SV1.02019071516.19.24cobh and Forever KidsWatch Call Me 2 KW-60 R36CWYDES4A292V1.02023.05.2422.49.44cobb allows malicious users to change the device IMEI-number which allows for forging the identity of the device...

PT-2025-5846

Name of the Vulnerable Software and Affected Versions: Forever KidsWatch Call Me KW50 R36 YDR A3PW GM7S V1.0 2019 07 15 16.19.24 cob h Forever KidsWatch Call Me 2 KW-60 R36CW YDE S4 A29 2 V1.0 2023.05.24 22.49.44 cob b Description: The built-in SMS configuration command in the affected devices...

Hitachi Energy RTU500 Scripting interface Trust Management Issue Vulnerability

RTU500 is a series of industrial control components from Hitachi, Japan, mainly used for industrial control systems.RTU500 Scripting interface is part of Hitachi Energy RTU500 series of industrial control components, mainly used to provide scripting programming interface to realize specific...