CVE-2025-2620-poc

CVE-2025-2620 Proof-of-Concept Exploit Overview This repository contains an advanced proof-of-concept PoC exploit for CVE-2025-2620 , a critical stack-based buffer overflow vulnerability discovered in the D-Link DAP-1620 router running firmware version 1.03. This vulnerability allows...

CVE-2026-85268 Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID

A Cross-Site Scripting XSS CWE-79 vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID...

CVE-2026-85268

A Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in the auth/handler component of Google Cloud Identity Platform and Firebase Authentication for iOS. Affected versions are those prior to 2026-08-14 . An unauthenticated remote attacker can exploit this by using a malicious iOS bundle ID ...

CVE-2026-85268 Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID

A Cross-Site Scripting XSS CWE-79 vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID...

CVE-2026-90579

A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function authorizehttpkey of the file core/cat/factory/customauthhandler.py. The manipulation of the argument userid leads to missing authentication. The attack may be initiated remotely. The exploit h...

EUVD-2026-77064

A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function authorizehttpkey of the file core/cat/factory/customauthhandler.py. The manipulation of the argument userid leads to missing authentication. The attack may be initiated remotely. The exploit h...

CVE-2026-90579

CVE-2026-90579 affects Cheshire Cat AI up to version 1.9.2 . The flaw resides in the _authorize_http_key function within core/cat/factory/custom_auth_handler.py, where manipulation of the user_id argument leads to missing authentication . An unauthenticated remote attacker can exploit this over t...

CVE-2026-90579 cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication

A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function authorizehttpkey of the file core/cat/factory/customauthhandler.py. The manipulation of the argument userid leads to missing authentication. The attack may be initiated remotely. The exploit h...

PT-2026-90950

Name of the Vulnerable Software and Affected Versions cheshire-cat-ai versions prior to 1.9.3 Description An issue exists where the manipulation of the user id argument in the authorize http key function within the core/cat/factory/custom auth handler.py file leads to missing authentication. This...

CVE-2026-85582: Allocation of Resources Without Limits or Throttling

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

Malicious code in auth-handler (npm)

Source: amazon-inspector 79d1be042f1565157d9c5e97b927919aa32bedb254b501aa374caf00c242ee83 The package auth-handler was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-55549

Yamcs , an open-source mission control framework, is vulnerable to reflected cross-site scripting (XSS) in the redirect_uri parameter of the GET /auth/authorize endpoint. The parameter is reflected into authorize.html without adequate HTML escaping by AuthHandler.java and HandlerContext.java , al...

GHSA-JFJ5-WRJ9-63X4 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

Summary In affected versions of langgraph-api the LangGraph Server runtime, the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the...

CVE-2026-35607

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 "self-registered users don't get execute perms" stripped Execute permission and Commands from users created via the...

CVE-2026-35607: Improper Privilege Management

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 "self-registered users don't get execute perms" stripped Execute permission and Commands from users created via the...

CVE-2026-22992

In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from monhandleauthdone Currently any error from cephauthhandlereplydone is propagated via finishauth but isn't returned from monhandleauthdone. This results in higher layers learning that despite...

EUVD-2025-204941

Malicious code in auth-handler npm...

Malicious code in auth-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79d1be042f1565157d9c5e97b927919aa32bedb254b501aa374caf00c242ee83 The package auth-handler was found to contain malicious code...

MAL-2025-192712 Malicious code in auth-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79d1be042f1565157d9c5e97b927919aa32bedb254b501aa374caf00c242ee83 The package auth-handler was found to contain malicious code...

Malicious Package

Overview auth-handler is a malicious package. This package contains malicious code associated with a social engineering campaign called "Contagious Interview." The attackers target developers through fake job interviews or coding test assignments that require the installation of this package. Onc...