EUVD-2026-83978

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...

CVE-2026-61687 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...

CVE-2026-61687

Hatchet , a platform for orchestrating background tasks, AI agents, and durable workflows, contains an unauthenticated OAuth state CSRF / login-CSRF vulnerability in its ValidateOAuthState function (prior to 0.91.1 ). After a successful OAuth callback, the function clears the oauth_state_ session...

CVE-2026-61687 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...

libkcapi: IV reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...

webkitgtk: Visiting a website may lead to an app denial-of-service

A flaw was found in WebKitGTK. Visiting a malicious website can cause an application denial of service due to improper state management...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process termination due to improper state management...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management...

chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation

A flaw was found in Skia, a 2D graphics library used in chromium-browser. This improper state validation vulnerability allows a remote attacker, who has already compromised the renderer process, to read memory outside of the security sandbox. This can be achieved by enticing a user to open a...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause a memory corruption issue due to improper state management and result in an unexpected process crash...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause a memory corruption issue due to improper state management and result in an unexpected process crash...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management...

CVE-2026-63116: Missing Authorization

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

UBUNTU-CVE-2026-94083

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. This requires app-layer.protocols.doh2 to be enabled, which is th...

CVE-2026-92435

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state...