GHSA-7G4W-CG88-2CQ2

creationtimestamp| type| source ---|---|--- 2026-08-28 20:59:24+00:00| seen| https://bsky.app/profile/newssecia.bsky.social/post/3mu6ax42wfx2g 2026-08-28 22:00:41+00:00| seen| https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html 2026-08-29 01:00:36+00:00| seen|...

MAL-2026-14305 Malicious code in mc-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1 Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README...

Malicious code in mc-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1 Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README...

CVE-2026-66803

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

CVE-2026-66803

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

CVE-2026-66803

CVE-2026-66803 affects Azure Cosmos DB and is described as improper access control that allows an unauthorized attacker to execute code over a network. The connected records corroborate this as a remote code execution vulnerability, with a CVSSv3.1 base score of 10.0 (CRITICAL) and network attack...

CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability

...

EUVD-2026-51302

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability

...

Microsoft Fixes CosmosEscape Flaw That Could Allow Any Cosmos DB Takeover

Cybersecurity researchers at Wiz found CosmosEscape in Azure's Gremlin API, exposing a master key that could access any Cosmos DB account. Microsoft fixed it, with no customer impact found...

Azure Cosmos DB Remote Code Execution Vulnerability

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database

A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service's Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz. Wiz , which codenamed the chain CosmosEscape , said the exploit chain began with a...

PT-2026-66599

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

CVE-2026-49447

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:39+00:00| published-proof-of-concept| https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-5fqm-cc34-fcf5...

CVE-2026-49446

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:37+00:00| published-proof-of-concept| https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659...

CVE-2026-49447

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

GHSA-2RX5-2G7J-2659 Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Summary The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate ...

CVE-2026-49447

Cosmos-Server 0.22.18 reportedly exposes constellation device metadata via GET /cosmos/api/constellation/public-devices when any non-empty Authorization header is provided; the code strips Bearer but does not validate or use the token in the DB query, allowing unauthenticated-like access to devic...

CVE-2026-49447 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

GHSA-5FQM-CC34-FCF5 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Summary GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This...