4 matches found
CVE-2026-49393 OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivalent transport or handler-level...
CVE-2026-49393
The OpenHuman agent harness (desktop application and Rust library) is vulnerable to an authentication bypass in versions prior to 0.56.0 . The core server fails to apply bearer middleware to Socket.IO rpc:request and chat:start handlers, even though it protects HTTP POST requests to /rpc. A local...
SUSE-SU-2026:2640-1 Security update for containerd
This update for containerd fixes the following issues - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260296. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...
