Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting

The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. id: CVE-2022-23397 info: name: Cedar Gate EZ-NET = 6.8.0 - Cross-Si...

GHSA-7GCF-G7XR-8HXJ vulnerabilities

Vulnerabilities for packages: cedar, qdrant, lychee, zed, yazi, atuin, komodo...

GHSA-7GCF-G7XR-8HXJ vulnerabilities

Vulnerabilities for packages: atuin, cedar, qdrant, zed, lychee, yazi...

CVE-2026-55773

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

CVE-2026-55773 CedarJava has a policy injection vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

CVE-2026-55773 CedarJava has a policy injection vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

CVE-2026-55773

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

CVE-2026-55772 CedarJava has a type confusion vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI...

GHSA-G4W6-VMGF-XQVX @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

Summary @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. An issue exists where, under...

CedarJava has policy injection vulnerability

Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow policy injection. Impact Cedar-expression injection via unescaped toCedarExpr The toCedarExpr metho...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the toCedarExpr method, which does not escape special characters when converting values to source code. An attacker can inject arbitrary expressions by supplying specially crafted input, potentially altering...

CedarJava has type confusion vulnerability

Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow type confusion across the Java-Rust FFI boundary. Impact Record-to-Entity type confusion across the...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' through improper handling of reserved keys in the JSON protocol when serializing CedarMap. An attacker can cause unauthorized access or manipulation of data by supplying...

PT-2026-50975

Name of the Vulnerable Software and Affected Versions CedarJava versions prior to 2.3.6 CedarJava versions prior to 3.4.1 CedarJava versions prior to 4.9 Description Improper input handling allows Record-to-Entity type confusion across the Java-Rust FFI Foreign Function Interface boundary...

PT-2026-50976

Name of the Vulnerable Software and Affected Versions CedarJava versions prior to 2.3.6 CedarJava versions prior to 3.4.1 CedarJava versions prior to 4.9.0 Description Improper input handling in the toCedarExpr method on Cedar Value types allows for Cedar-expression injection. The method fails to...

CVE-2026-25727 vulnerabilities

Vulnerabilities for packages: cedar, pixi, starship, uutils, rust-analyzer, sqlx, lychee, zellij, shadowsocks-rust, atuin, mountpoint-s3, samply, qdrant, cargo-audit, zizmor, kdash, linkerd2-proxy, rye, berg, uv, wasm-pack, geckodriver, yazi, wasmcloud, ztunnel, cargo-c, parseable, zed, buck2,...

GHSA-R6V5-FH4H-64XC vulnerabilities

Vulnerabilities for packages: cedar, pixi, starship, uutils, rust-analyzer, sqlx, lychee, zellij, shadowsocks-rust, atuin, mountpoint-s3, samply, qdrant, cargo-audit, zizmor, kdash, linkerd2-proxy, rye, berg, uv, wasm-pack, geckodriver, yazi, wasmcloud, ztunnel, cargo-c, parseable, zed, buck2,...

CVE-2026-25727 vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, rust-analyzer, lychee, py3-xet-core, eza, buck2, starship, zed, yazi, jujutsu, quiche, zizmor, oranda, nushell, wash, berg, pixi, topgrade, guestproxyagent, fnm, komodo, cedar, ztunnel, cargo-audit, ztunnel-fips, bat, kdash, sccache, zellij, virtiofsd...

GHSA-R6V5-FH4H-64XC vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, rust-analyzer, lychee, py3-xet-core, eza, buck2, starship, zed, yazi, jujutsu, quiche, zizmor, oranda, nushell, wash, berg, pixi, topgrade, guestproxyagent, fnm, komodo, cedar, ztunnel, cargo-audit, ztunnel-fips, bat, kdash, sccache, zellij, virtiofsd...

CVE-2022-23397

The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im reference has "no...