81115 matches found
PT-2026-63301
Name of the Vulnerable Software and Affected Versions Gitea version 1.25.5 Description An insufficient authorization issue exists in the LFS server where the system uses the UserID embedded in an LFS JWT to make cross-repository authorization decisions via the LFSObjectAccessible function. When a...
PT-2026-63313
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The ToHook function in services/webhook/general.go decrypts the HeaderAuthorizationEncrypted field and returns the plaintext authorization header in the API response. This allows repository...
PT-2026-62121
Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without valid authentication...
PT-2026-63264
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization bypass occurs when user-controlled keys are used, allowing an attacker to disclose information. This happens via user-supplied identifiers that reference scheduled query resul...
PT-2026-63261
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing authorization allows a user with limited feature privileges to access workflow execution outputs within their Kibana space. This occurs because the documented API does not properly...
PT-2026-61932
Name of the Vulnerable Software and Affected Versions FlexCity versions 5.536.0 through 5.541.0 Description Missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update FlexCity to version 5.542.0 or later...
PT-2026-62410
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user can access and modify Cloud Connect configuration and service settings without the necessary feature privileges. This occurs due to missing authorization in product...
Incorrect Authorization
Overview @ai-sdk/harness-codex is a HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex CLI. The adapter ships a bridge process that runs inside a sandbox and talks to the host over a WebSocket on a sandbox-proxied l Affected versions of this package are vulnerable to Incorrect...
Missing Authorization
Overview @astrojs/vercel is a Deploy your site to Vercel Affected versions of this package are vulnerable to Missing Authorization via the isr process. An attacker can access protected content by sending unauthenticated GET requests with a crafted xastropath query parameter, causing the server to...
Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL System.Net.Security. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A security feature bypass...
EUVD-2026-44396
Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability...
Prototype Pollution
Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the Node HTTP adapter lib/adapters/http.js, which reads config.proxy through the prototype chain after a request interceptor return...
CVE-2026-57494
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...
CVE-2026-57494 AgenticMail: Cross-agent task authorization bypass in AgenticMail API
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...
CVE-2026-57494 AgenticMail: Cross-agent task authorization bypass in AgenticMail API
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...
CVE-2026-57494 AgenticMail: Cross-agent task authorization bypass in AgenticMail API
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...
EUVD-2026-42341
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch...
EUVD-2026-44673
Directus: Authorization-dependent response served from unsegmented cache key...
GHSA-C6W9-5G5J-JH2P Directus: Authorization-dependent response served from unsegmented cache key
Summary When response caching is enabled CACHEENABLED=true, the cache-key derivation in api/src/utils/get-cache-key.ts includes only version, path, query, and accountability.user plus a conditional ip. Authorization context beyond user share, role, roles, admin, app, policies is not part of the...