CVE-2026-113459 Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only...

PT-2026-118420

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions 1.3.0.Final through 1.3.1.Final Description The AndroidA2AHttpClient synchronous POST path incorrectly overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with a default followRedirects value ...

PT-2026-118316

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only...

PT-2026-120295

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...

CVE-2026-112268

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

CVE-2026-112268 sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

CVE-2026-112268 sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

EUVD-2026-104305

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

CVE-2026-112268

The sglang-router (sgl-model-gateway) version 0.3.2 and below is vulnerable to an authorization bypass due to insufficient access control on mesh HA management routes . Specifically, the */ha/ endpoints fail to perform required control-plane Admin role checks. This allows holders of a standard da...

CVE-2026-112268 sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

CVE-2026-112268

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

CVE-2026-112268: Incorrect Authorization

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

PT-2026-117412

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

Apache Answer log information disclosure vulnerability

Apache Answer versions 2.0.2 and earlier contain a vulnerability related to log information leakage. This vulnerability arises from writing sensitive information to log files; each authentication request writes the full API key into the application logs. As a result, individuals with log reading...

CVE-2026-112014

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

CVE-2026-112014

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

EUVD-2026-103467

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...