116391 matches found
A2A Java SDK has a fail-open default task authorization
Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...
CVE-2025-30772
🚨 CVE-2025-30772 - Privilege Escalation in WPC Smart Upsell Funnel for WooCommerce 📅 Published: March 27, 2025 🔐 CVSS Score: 8.8 High 🔥 CWE-862: Missing Authorization 🐞 Vulnerability Summary A Missing Authorization vulnerability in the WPC Smart Upsell Funnel for WooCommerce plugin allows...
CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...
EUVD-2026-105361
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...
CVE-2026-112712
The @fastify/middie middleware engine for Fastify (versions 9.0.0 through 9.3.5 ) is vulnerable to a path-scoped middleware bypass . The use() function incorrectly joins mount paths with plugin scope prefixes, specifically when the prefix ends in a slash, contains array mount paths, or lacks a le...
CVE-2026-86411
An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...
CVE-2026-86409
Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...
CVE-2026-112380
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To...
EUVD-2026-105314
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...
CVE-2026-87866
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...
CVE-2026-112380 Missing authorization in the WhatsApp channel in Kiro Crew
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To...
CVE-2026-112380 Missing authorization in the WhatsApp channel in Kiro Crew
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To...
CVE-2026-112380
The Kiro Crew software is vulnerable to missing authorization in the WhatsApp group channel. This flaw allows a remote actor who is a member of an operator-configured WhatsApp group to send messages that take control of the operator's other agent sessions. Consequently, the attacker may be able t...
EUVD-2026-105278
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To...
CVE-2026-86411
An "ftp://" transfer configured with "CURLUSESSLNONE" can reuse a pooled FTP control connection that a previous easy handle upgraded with "STARTTLS" and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...
CVE-2026-86411
An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...
CVE-2026-86409
Setting "CURLOPTAWSSIGV4" to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an "Authorization: AWS4-HMAC-SHA256" header to whatever URL isset next, leaking state information...
GHSA-VWWX-PX9W-CRRC ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
Summary The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid...
ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
Summary The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid...
npm: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
npm: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...