210929 matches found
CVE-2026-116684
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with tokenverifier accepts a valid token issued for another service when the...
CVE-2026-118681
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path...
CVE-2026-118690
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...
CVE-2026-61571 AVideo-Encoder: missing authentication on control and status endpoints
AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. view/run.php has a commented-out guard and invokes Encoder::run. view/queue.json.php calls Encoder::getAlltrue, reveals...
Waline login accepts a non-string email as a match-all MongoDB query
Summary The login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as "$ne": null, the MongoDB storage adapter's parseWhere silently DROPS...
CVE-2026-118690 Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...
CVE-2026-118690
The Signal K Server version before 2.33.0 is vulnerable to a missing authentication flaw in the /skServer/ziplogs endpoint. This vulnerability allows unauthenticated remote attackers to download log archives containing a security.json file. By extracting the JWT secretKey from this file, an attac...
CVE-2026-118690 Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...
LangGraph JavaScript custom authentication may permit cross-user Store access
Summary LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an authorization handler. In affected deployments, an authenticated user may be able to access Store data outside their authorized namespace. Required...
GHSA-4HM6-W6QQ-W73V LangGraph JavaScript custom authentication may permit cross-user Store access
Summary LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an authorization handler. In affected deployments, an authenticated user may be able to access Store data outside their authorized namespace. Required...
EUVD-2026-112487
langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operatio...
CVE-2026-118665 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...
CVE-2026-118665
The @graphql-tools/executor-legacy-ws package is vulnerable to stale authentication state persistence due to a flaw in the buildWSLegacyExecutor component. Specifically, the executorConnectionParams object in packages/executors/legacy-ws/src/index.ts retains values from request.extensions.connect...
CVE-2026-118665 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...
CVE-2026-76418
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service...
CVE-2026-3583
When the allowedscopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned...
CVE-2026-11854
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables...
CVE-2026-76418
A logic error in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to cause the device to reload unexpectedly, leading to a denial-of-service (DoS) condition. The vulnerability is triggered by sending a crafted request when ...
CVE-2026-76418 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service...
CVE-2026-76418 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service...