CVE-2026-123024

A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function getcurrentuserid of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed...

EUVD-2026-117463

A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function getcurrentuserid of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed...

CVE-2026-123024 agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication

A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function getcurrentuserid of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed...

CVE-2026-123024

A vulnerability exists in agentscope-ai AgentScope up to version 2.0.11 affecting the Agent Service component. Specifically, the get_current_user_id function in src/agentscope/app/deps.py is susceptible to missing authentication when an attacker manipulates the X-User-ID argument. This flaw allow...

CVE-2026-108548

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's authhandler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-...

CVE-2026-108548 AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's authhandler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-...

CVE-2026-108548 AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's authhandler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-...

CVE-2026-108548

AstronRPA versions through 1.1.6 are vulnerable to an authentication bypass due to a flaw in the OpenResty gateway's auth_handler.lua component. The system fails to validate Bearer tokens , allowing unauthenticated attackers to provide arbitrary values to access the /api/resource/ and /api/rpa-ai...

User Impersonation

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to User Impersonation via the wsterminal process. An attacker can gain unauthorized access to another user's terminal session by injecting crafted values into the sessionid parameter, causing the backend to...

CVE-2026-59224

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/openwebui/routers/terminals.py built the wsterminal upstream URL from an unencoded sessionid and appended userid as a query parameter, allowing query injection to make the terminal backe...

CVE-2026-59224: Improper Authentication

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/openwebui/routers/terminals.py built the wsterminal upstream URL from an unencoded sessionid and appended userid as a query parameter, allowing query injection to make the terminal backe...

CVE-2026-22797

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The externaloauth2token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged...

CVE-2020-35666

Steedos Platform (until version 1.21.24) is affected by a NoSQL injection in the /api/collection/findone handler. The underlying issue is inadequate validation of req.body in server/packages/steedos_base.js, which can be exploited using MongoDB operators (e.g., X-User-Id[$ne]=1) to influence quer...

CVE-2020-35666: Improper Neutralization of Special Elements used in an SQL Command

Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedosbase.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id$ne=1 value...