344 matches found
GHSA-P3M5-59MP-JV5R vulnerabilities
Vulnerabilities for packages: keep-fips, keep, homepage, peerdb-ui, jitsucom-jitsu...
CVE-2026-94482 vulnerabilities
Vulnerabilities for packages: keep-fips, keep, homepage, peerdb-ui, jitsucom-jitsu...
GHSA-2464-FHR4-W9XW vulnerabilities
Vulnerabilities for packages: keep-fips, keep, homepage, peerdb-ui, jitsucom-jitsu...
GHSA-P3M5-59MP-JV5R vulnerabilities
Vulnerabilities for packages: jitsucom-jitsu...
CVE-2026-94482 vulnerabilities
Vulnerabilities for packages: jitsucom-jitsu...
GHSA-2464-FHR4-W9XW vulnerabilities
Vulnerabilities for packages: jitsucom-jitsu...
CVE-2026-115509
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors...
EUVD-2026-108341
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors...
CVE-2026-115509 Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors...
CVE-2026-115509 Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors...
CVE-2026-115509
Jitsu Console versions prior to 2.14.0-beta.41 are vulnerable to a cross-workspace authorization bypass within the sources/state.ts handlers. The root cause is that these handlers call findFirst without the await keyword, which prevents the syncId ownership check from failing as intended. Consequ...
CVE-2026-115509 Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors...
PT-2026-121583
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors...
Jitsu authorization issue vulnerability
Versions prior to jitsu 2.14.0-beta.41 contain an authorization issue vulnerability. This vulnerability arises because the sources/state.ts handler fails to use await when calling findFirst; as a result, ownership checks for sync IDs never fail. Consequently, authenticated users can read,...
GHSA-X8MW-P69M-V3MX vulnerabilities
Vulnerabilities for packages: commercial-gitlab-rails-ee, gitlab-rails-ce, gitlab-rails-ce-fips, langfuse, langfuse-fips, kibana, commercial-gitlab-rails-ee-fips, jitsucom-jitsu...
CVE-2026-19481 vulnerabilities
Vulnerabilities for packages: commercial-gitlab-rails-ee, gitlab-rails-ce, gitlab-rails-ce-fips, langfuse, langfuse-fips, kibana, commercial-gitlab-rails-ee-fips, jitsucom-jitsu...
GHSA-X8MW-P69M-V3MX vulnerabilities
Vulnerabilities for packages: langfuse, jitsucom-jitsu...
CVE-2026-19481 vulnerabilities
Vulnerabilities for packages: langfuse, jitsucom-jitsu...