Linux Distros Unpatched Vulnerability : CVE-2026-73501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473

The CVE concerns @cedar-policy/authorization-for-expressjs, an Express middleware that applies Cedar authorization by mapping HTTP requests to Cedar actions. A concrete flaw in versions up to 0.2.x is that the middleware uses req.originalUrl (which includes the query string) to identify Cedar act...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

DEBIAN-CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

EUVD-2026-57598

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73501 kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73423

Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware primitive, while actions and pages can dispatch to user code independently. Mounting actions before middleware, as in the...

CVE-2026-73423

Astro (web framework) vulnerability CVE-2026-73423 affects the composable astro/hono pipeline from versions 7.0.0–7.0.6. If actions() or pages() are mounted before middleware(), or if middleware() is omitted, security.checkOrigin is not enforced at dispatch sinks, allowing blind write‑only CSRF a...

CVE-2026-73423 Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware primitive, while actions and pages can dispatch to user code independently. Mounting actions before middleware, as in the...

EUVD-2026-57608

Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware primitive, while actions and pages can dispatch to user code independently. Mounting actions before middleware, as in the...

next.js: Next.js: Unauthorized access to protected content via middleware bypass

A flaw was found in Next.js. App Router applications that use middleware or proxy-based authorization checks are vulnerable to unauthorized access. A remote attacker can exploit this by crafting specific .rsc and segment-prefetch URLs, which bypass the intended middleware rules. This allows acces...

next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n

A flaw was found in Next.js. Applications utilizing the Pages Router with internationalization i18n configured and middleware or proxy-based authorization are susceptible to unauthorized access. A remote attacker can exploit this by making locale-less /next/data//.json requests, which bypass the...

Next.js: Next.js: Authorization bypass via crafted query parameters

A flaw was found in Next.js. This vulnerability allows an attacker to bypass security checks in web applications that use Next.js middleware to protect specific web pages. By sending specially crafted web addresses, an attacker can access protected content without proper authorization. This could...

next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack

A flaw was found in Next.js. A remote unauthenticated attacker could exploit a bypass in a security fix when using middleware.ts with Turbopack. This vulnerability could lead to the disclosure of sensitive information...