aio-tests-mcp (>=0.1.0, <=0.1.2), aiowhitebit-mcp (0.2.5) +4 more potentially affected by CVE-2025-64340 via fastmcp (2.5.1)

fastmcp PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aio-tests-mcp =0.1.0, =0.1.8, =1.0.0, =1.0.78 - iflow-mcp-sean-tate-fastmcp-python-oauth2-with-entra-id 0.1.0 - sakit 11.0.0 Source cves:...

aio-tests-mcp (>=0.1.0, <=0.1.2), aiowhitebit-mcp (0.2.5) +4 more potentially affected by CVE-2026-27124 via fastmcp (2.5.1)

fastmcp PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aio-tests-mcp =0.1.0, =0.1.8, =1.0.0, =1.0.78 - iflow-mcp-sean-tate-fastmcp-python-oauth2-with-entra-id 0.1.0 - sakit 11.0.0 Source cves:...

aio-tests-mcp (>=0.1.0, <=0.1.2), aiowhitebit-mcp (0.2.5) +4 more potentially affected by CVE-2026-32871 via fastmcp (2.5.1)

fastmcp PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aio-tests-mcp =0.1.0, =0.1.8, =1.0.0, =1.0.78 - iflow-mcp-sean-tate-fastmcp-python-oauth2-with-entra-id 0.1.0 - sakit 11.0.0 Source cves:...

aio-tests-mcp (>=0.1.0, <=0.1.2), aiowhitebit-mcp (0.2.5) +4 more potentially affected by CVE-2026-32871 via fastmcp (2.5.1)

fastmcp PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aio-tests-mcp =0.1.0, =0.1.8, =1.0.0, =1.0.78 - iflow-mcp-sean-tate-fastmcp-python-oauth2-with-entra-id 0.1.0 - sakit 11.0.0 Source cves:...

aio-tests-mcp (>=0.1.0, <=0.1.2), aiowhitebit-mcp (0.2.5) +4 more potentially affected by CVE-2026-27124 via fastmcp (2.5.1)

fastmcp PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aio-tests-mcp =0.1.0, =0.1.8, =1.0.0, =1.0.78 - iflow-mcp-sean-tate-fastmcp-python-oauth2-with-entra-id 0.1.0 - sakit 11.0.0 Source cves:...

Expedia Group: undisclosed vulnerability (ZAI-2026-NB0V53)

Not disclosed. Details are not yet publicly disclosed...

Expedia Group: undisclosed vulnerability (ZAI-2026-VKPRIY)

Not disclosed. Details are not yet publicly disclosed...

Expedia Group: undisclosed vulnerability (ZAI-2026-8V3WOJ)

Not disclosed. Details are not yet publicly disclosed...

WordPress Widgets for Expedia Reviews Plugin <= 11.0.2 is vulnerable to Arbitrary File Upload

Software Widgets for Expedia Reviews Type Plugin Vulnerable versions = 11.0.2 Fixed in 11.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-48275 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID ebd1ac137457 Credits Rafie Muhammad Patchstack...

Expedia Group Bug Bounty: https://www.wotif.com/vc/blog/info.php script is prone to reflected HTML/CSS injection and COOKIE leak

The info.php script on https://www.wotif.com was vulnerable to reflected HTML/CSS injection and COOKIE leak due to caching of HTTP headers. An attacker could inject malicious HTML/CSS code and steal victim cookies. The vulnerability was reported to the vendor...

Expedia Group Bug Bounty: Open Redirect in Logout & Login

An open redirect vulnerability was discovered in the logout and login functionality of Expedia's website. An attacker could exploit this vulnerability by manipulating the "rurl" parameter in the logout URL to redirect users to a malicious website, potentially leading to phishing or social...

Expedia Group Bug Bounty: Sensitive information for phpinfo.php at https://products.ean.com/

Vulnerability description not provided...

Expedia Group Bug Bounty: Cache Poisoning Allows Stored XSS Via hav Cookie Parameter (To Account Takeover)

A cache poisoning vulnerability allowed for stored cross-site scripting XSS attacks via the "hav" cookie parameter on abritel.fr, leading to account takeover. The server had a protection mechanism that hid double quotes, but not greater than and less than symbols, which allowed the attacker to...

Expedia Group Bug Bounty: Cache Deception Allows Account Takeover

A vulnerability allowed an attacker to extract a user's session token from a cacheable page, leading to account takeover. The session token was reflected in the response of a cacheable URL, and the server responded with a 200 OK. The caching server saw the response as cacheable due to the file...

Expedia Group Bug Bounty: Reflected XSS Via origCity Parameter (UPPER Case + WAF Protection Bypass)

Vulnerability description not provided...

CVE-2020-6858

creationtimestamp| type| source ---|---|--- 2020-02-10 11:28:30+00:00| published-proof-of-concept| https://github.com/ExpediaGroup/styx/security/advisories/GHSA-6v7p-v754-j89v...

expediafr.custhelp.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-932964 Security Researcher AmalThamban Helped patch 3 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting expediafr.custhelp.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines...

expedia.at XSS vulnerability

Open Bug Bounty ID: OBB-648548 Description| Value ---|--- Affected Website:| expedia.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Orbitz Warns 880,000 Payment Cards Suspected Stolen

Expedia-owned travel site Orbitz said Tuesday a possible breach of both its consumer and partner platforms may have led to the disclosure of 880,000 payment cards. According to Expedia, criminals had access to Orbitz consumer and business partner platforms, but not the Orbitz.com website. The...

Expedia Orbitz Travel, Flights, Hotel Booking Site Compromised

Chicago-based online travel booking company Orbitz, a subsidiary of Expedia.com, reveals that one of its old websites has been hacked, exposing nearly 880,000 payment card numbers of the people who made purchases online. Orbitz.com is a travel fare aggregator website and travel metasearch engine,...