61 matches found
Missing Authentication for Critical Function
Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via improper path normalization in the whitelist logic. An attacker can gain unauthorized access to protected API endpoints by sending crafted requests that bypass authentication checks. This...
CVE-2026-0650 OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization
OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials...
PT-2026-1559
Name of the Vulnerable Software and Affected Versions OpenFlagr versions prior to and including 1.1.18 Description The software contains an authentication bypass issue in the HTTP middleware. Improper path normalization within the whitelist logic allows crafted requests to bypass authentication,...
Security update 5.1.1 for Multi-Linux Manager Client Tools
This update fixes the following issues: golang-github-prometheus-alertmanager: Update to version 0.28.1 jscPED-13285: Improved performance of inhibition rules when using Equal labels. Improve the documentation on escaping in UTF-8 matchers. Update alertmanagerconfighash metric help to document th...
EUVD-2025-13288
Malicious code in bioql PyPI...
Malicious code in feature-flags-client (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 26770c72a74ae8e621acc8084a53a285191b262988dd73d9e884c34025a362b8 The OpenSSF Package Analysis project identified 'feature-flags-client' @ 1.1.0.4.g5ec4367 rubygems as malicious. It is considered malicious...
MAL-2025-46907 Malicious code in feature-flags-client (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 26770c72a74ae8e621acc8084a53a285191b262988dd73d9e884c34025a362b8 The OpenSSF Package Analysis project identified 'feature-flags-client' @ 1.1.0.4.g5ec4367 rubygems as malicious. It is considered malicious...
Linux Distros Unpatched Vulnerability : CVE-2021-22223
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf o...
MAL-2025-6420 Malicious code in frontend-feature-flags (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in frontend-feature-flags (npm)
--- -= Per source details. Do not edit below this line.=-...
OESA-2025-1577 libbpf security update
A mirror of bpf-next linux tree bpf-next/tools/lib/bpf directory plus its supporting header files. The version of the package reflects the version of ABI. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: libbpf: Use OPTSSET macro in bpfxdpquery When the...
Information Disclosure
Flags SDK is vulnerable to information disclosure. The vulnerability is due to a flaw in the flags discovery endpoint that allows attackers with detailed knowledge of the issue to list all feature flags, including names, descriptions, options, and default values...
CVE-2025-46332
Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1 and prior as certain circumstances allows a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags...
Information Disclosure via Flags override link
Summary An information disclosure vulnerability affecting Flags SDK has been addressed. It impacted flags ≤3.2.0 and @vercel/flags ≤3.1.1 and in certain circumstances, allowed a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint...
GHSA-892P-PQRR-HXQR Information Disclosure via Flags override link
Summary An information disclosure vulnerability affecting Flags SDK has been addressed. It impacted flags ≤3.2.0 and @vercel/flags ≤3.1.1 and in certain circumstances, allowed a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint...
CVE-2025-46332
Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1 and prior as certain circumstances allows a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags...
CVE-2025-46332
The CVE-2025-46332 entry concerns Flags SDK (for Next.js and SvelteKit) with information disclosure via the flags discovery endpoint. Affected: flags <= 3.2.0 and @vercel/flags
PT-2025-18911 · Vercel +1 · @Vercel/Flags +1
Name of the Vulnerable Software and Affected Versions: Flags versions 3.2.0 and prior @vercel/flags versions 3.1.1 and prior Description: The issue allows for information disclosure, where a bad actor could gain access to a list of all feature flags exposed through the "flags discovery endpoint"...
Malicious code in oss-feature-flags (npm)
--- -= Per source details. Do not edit below this line.=-...
DEBIAN-CVE-2024-27050
In the Linux kernel, the following vulnerability has been resolved: libbpf: Use OPTSSET macro in bpfxdpquery When the featureflags and xdpzcmaxsegs fields were added to the libbpf bpfxdpqueryopts, the code writing them did not use the OPTSSET macro. This causes libbpf to write to those fields...