183 matches found
CVE-2025-63783
A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...
CVE-2025-63783: Improper Input Validation
A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...
CVE-2025-63783
A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...
Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module
Vulnerability Description --- Vulnerability Overview - When the client sends an arbitrary URL array and impl: "naive" to the tRPC endpoint tools.search.crawlPages, the server issues outbound HTTP requests directly to those URLs. There is no defensive logic that restricts or validates requests to...
EUVD-2025-12106
Malicious code in bioql PyPI...
CVE-2025-59305
Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated user to invoke migration control functions. This can lead to data corruption or denial of service through unauthorized access to TRPC endpoints such as backgroundMigrations.all,...
CVE-2025-59305: Improper Authorization
Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated user to invoke migration control functions. This can lead to data corruption or denial of service through unauthorized access to TRPC endpoints such as backgroundMigrations.all,...
Denial Of Service (DoS)
@trpc/server is vulnerable to Denial Of Service DoS. The vulnerability is due to improper input validation due in unhandled error when validating malformed connectionParams in WebSocket connections, allowing unauthenticated users to crash the server...
CVE-2025-43855
tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to cras...
@ms-cloudpack/api-server (>=0.61.15, <=0.61.17), @secrecy/trpc-api-types (>=1.33.0-feat-next15.1, <=1.33.0-feat-next15.2) +3 more potentially affected by CVE-2025-43855 via @trpc/server (>=11.0.1, <=11.1.0)
@trpc/server NPM version =11.0.1, =0.61.15, =1.33.0-feat-next15.1, =10.1.0, =10.2.1 - tempest.games 0.2.0 Source cves: CVE-2025-43855 Source advisory: GHSA-PJ3V-9CM8-GVJ8...
@ms-cloudpack/api-server (>=0.61.15, <=0.61.17), @secrecy/trpc-api-types (>=1.33.0-feat-next15.1, <=1.33.0-feat-next15.2) +3 more potentially affected by CVE-2025-43855 via @trpc/server (>=11.0.1, <=11.1.0)
@trpc/server NPM version =11.0.1, =0.61.15, =1.33.0-feat-next15.1, =10.1.0, =10.2.1 - tempest.games 0.2.0 Source cves: CVE-2025-43855 Source advisory: OSV:GHSA-PJ3V-9CM8-GVJ8...
tRPC 11 WebSocket DoS Vulnerability
Summary An unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server. Details Any tRPC 11 server with WebSocket enabled with a createContext method set is vulnerable. Here is a...
GHSA-PJ3V-9CM8-GVJ8 tRPC 11 WebSocket DoS Vulnerability
Summary An unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server. Details Any tRPC 11 server with WebSocket enabled with a createContext method set is vulnerable. Here is a...
CVE-2025-43855
tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to cras...
CVE-2025-43855
tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to cras...
CVE-2025-43855 tRPC 11 WebSocket DoS Vulnerability
tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to cras...
CVE-2025-43855
CVE-2025-43855 affects tRPC 11 WebSocket servers (versions 11.0.0–11.1.0) where validating malformed connectionParams can throw an unhandled error, crashing the server. Any unauthenticated user can trigger this on WebSocket-enabled servers with a createContext method. The issue has been patched i...
CVE-2025-43855 tRPC 11 WebSocket DoS Vulnerability
tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to cras...
CVE-2025-43855 tRPC 11 WebSocket DoS Vulnerability
tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to cras...
@ms-cloudpack/api-server (>=0.61.15, <=0.61.17), @secrecy/trpc-api-types (>=1.33.0-feat-next15.1, <=1.33.0-feat-next15.2) +3 more potentially affected by CVE-2025-43855 via @trpc/server (>=11.0.1, <=11.1.0)
@trpc/server NPM version =11.0.1, =0.61.15, =1.33.0-feat-next15.1, =10.1.0, =10.2.1 - tempest.games 0.2.0 Source cves: CVE-2025-43855 Source advisory: MEND:CVE-2025-43855...