21 matches found
CVE-2026-113727
OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/runName update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the...
CVE-2026-113727
OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/runName update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the...
PT-2026-119042
Name of the Vulnerable Software and Affected Versions OpenChoreo versions prior to 1.0.6 OpenChoreo versions prior to 1.1.7 OpenChoreo versions prior to 1.2.5 Description An authorization flaw exists in the PUT ".../workflowruns/runName" endpoint. The system authorizes requests based on the...
EUVD-2026-61711
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite component: Product Diagnostic Tools. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order...
EUVD-2026-61587
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Partner...
CVE-2026-19177 Insufficient validation of untrusted input in UI
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Rethinking AI Cloud Infrastructure for Agentic Serving Systems with the Aries Experimentation Framework
Autonomous agents challenge conventional LLM serving by coupling repeated inference with persistent context and sandboxed tool execution. We present Aries, a full-stack experimentation framework that separates task semantics from execution configurations, reconstructs cross-component agent...
CVE-2026-49212 Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier props vs propsFromParent, or request contex...
CVE-2026-49212 Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier props vs propsFromParent, or request contex...
symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding
Description In symfony/ux-live-component, a component's server-side state is exposed to the browser as a set of props LiveProp-annotated properties. Props marked writable: true can be freely changed by the client. Read-only props are round-tripped to the browser and back, and their integrity is...
GHSA-34W5-C283-J9FG symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding
Description In symfony/ux-live-component, a component's server-side state is exposed to the browser as a set of props LiveProp-annotated properties. Props marked writable: true can be freely changed by the client. Read-only props are round-tripped to the browser and back, and their integrity is...
PT-2026-51053
Name of the Vulnerable Software and Affected Versions symfony/ux-live-component versions prior to 2.x and 3.x Description An issue exists in the SymfonyUXLiveComponentLiveComponentHydrator where the HMAC Hash-based Message Authentication Code used to protect read-only props and the propsFromParen...
CVE-2026-45028 Astro: Server island encrypted parameters vulnerable to cross-component replay
Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypte...
CVE-2026-45028 Astro: Server island encrypted parameters vulnerable to cross-component replay
Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypte...
CVE-2026-45028 Astro: Server island encrypted parameters vulnerable to cross-component replay
Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypte...
CVE-2026-45028
Astro prior to 6.1.10 used AES-GCM to protect server island props and slots but did not bind ciphertext to the target component/type, enabling replay of an encrypted props value as a slots value (and vice versa). This could cause XSS when overlapping prop/slot keys occur in dynamically rendered p...
GHSA-XR5H-PHRJ-8VXV Astro: Server island encrypted parameters vulnerable to cross-component replay
Impact Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypted props p value as...
NPM: Astro: Server island encrypted parameters vulnerable to cross-component replay
NPM: Astro: Server island encrypted parameters vulnerable to cross-component replay vulnerability discovered by ? in WordPress Npm astro versions 6.1.10...
Astro: Server island encrypted parameters vulnerable to cross-component replay
Impact Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypted props p value as...