Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration through the Session API. An attacker can authenticate on behalf of the user by repeatedly using idp intents to retrieve the id and token from the application's URI. Remediation Upgrade...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration through the Session API. An attacker can authenticate on behalf of the user by repeatedly using idp intents to retrieve the id and token from the application's URI. Remediation Upgrade...

Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`

Impact: A security issue has been found in terraform-provider-windns before version 1.0.5. The windnsrecord resource did not santize the input variables. This can lead to authenticated command injection in the underlyding powershell command prompt. Patches: 83ef736 fix: better input validation...

GHSA-4VGF-2CM4-MP7C Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`

Impact: A security issue has been found in terraform-provider-windns before version 1.0.5. The windnsrecord resource did not santize the input variables. This can lead to authenticated command injection in the underlyding powershell command prompt. Patches: 83ef736 fix: better input validation...

Terraform WinDNS Provider 命令注入漏洞

Terraform WinDNS Provider is a Norsk rikskringkasting open source tool for managing DNS records in Windows DNS servers using Terraform. A command injection vulnerability exists in Terraform WinDNS Provider versions prior to 1.0.5, which stems from failure to clean up input variables and could lea...

PT-2025-19981 · Hashicorp · Terraform Windns Provider

Name of the Vulnerable Software and Affected Versions: Terraform WinDNS Provider versions prior to 1.0.5 Description: A security issue has been found in the Terraform WinDNS Provider, where the windns record resource did not sanitize the input variables, leading to authenticated command injection...

MAL-2025-3682 Malicious code in feather-provider-filter (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c10e095a2bc88b96e5a1f9fabb7eefe0ff0596b0e3b3bf085fdcf95165c4689 Any computer that has this package installed or running should be considered...

Malicious code in feather-provider-filter (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c10e095a2bc88b96e5a1f9fabb7eefe0ff0596b0e3b3bf085fdcf95165c4689 Any computer that has this package installed or running should be considered...

CVE-2025-22872 affecting package kube-vip-cloud-provider for versions less than 0.0.10-4

CVE-2025-22872 affecting package kube-vip-cloud-provider for versions less than 0.0.10-4. A patched version of the package is available...

SUSE CVE-2023-53092

In the Linux kernel, the following vulnerability has been resolved: interconnect: exynos: fix node leak in probe PM QoS error path Make sure to add the newly allocated interconnect node to the provider before adding the PM QoS request so that the node is freed on errors...

CVE-2023-53092

In the Linux kernel, the following vulnerability has been resolved: interconnect: exynos: fix node leak in probe PM QoS error path Make sure to add the newly allocated interconnect node to the provider before adding the PM QoS request so that the node is freed on errors...

DEBIAN-CVE-2023-53092

In the Linux kernel, the following vulnerability has been resolved: interconnect: exynos: fix node leak in probe PM QoS error path Make sure to add the newly allocated interconnect node to the provider before adding the PM QoS request so that the node is freed on errors...

@iflow-mcp/git-mcp (1.0.0), mtmag (0.0.1) +4 more potentially affected by CVE-2025-4144 via @cloudflare/workers-oauth-provider (0.0.2)

@cloudflare/workers-oauth-provider NPM version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @cloudflare/workers-oauth-provider and may be impacted: - @iflow-mcp/git-mcp 1.0.0 - mtmag 0.0.1 - mtmaiadmin =0.0.694, =0.0.1, =0.8.11, =0.8.17 Source...

GHSA-QGP8-V765-QXX9 @cloudflare/workers-oauth-provider PKCE bypass via downgrade attack

Summary PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework. However, it was found that an attacker could cause the check to be skipped. Impact PKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension ...

@iflow-mcp/git-mcp (1.0.0), mtmag (0.0.1) +4 more potentially affected by CVE-2025-4143 via @cloudflare/workers-oauth-provider (0.0.2)

@cloudflare/workers-oauth-provider NPM version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @cloudflare/workers-oauth-provider and may be impacted: - @iflow-mcp/git-mcp 1.0.0 - mtmag 0.0.1 - mtmaiadmin =0.0.694, =0.0.1, =0.8.11, =0.8.17 Source...

GHSA-7CP4-JW97-3RC2 Duplicate Advisory: @cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4pc9-x2fx-p7vj. This link is maintained to preserve external references. Original Description The OAuth implementation in workers-oauth-provider that is part of MCP framework...

CVE-2025-4144

PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27...

CVE-2025-4144

PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27...

CVE-2025-4143

The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirecturi was on the allowed list of redirect URIs for the given client registration. Fixed in: ...

CVE-2025-4143 Missing validation of redirect_uri on authorize endpoint

The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirecturi was on the allowed list of redirect URIs for the given client registration. Fixed in: ...