46554 matches found
CVE-2026-29793 NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method get, patch, update, remove. The transport layer performs no type...
CVE-2026-29793
Feathersjs vulnerability CVE-2026-29793 affects Feathersjs 5.0.0–5.0.41 with Socket.IO client-supplied ids not type-checked, which may pass as MongoDB operators (e.g., {$ne: null}) into queries via the MongoDB adapter. This can cause unintended document matches and impacts on confidentiality, int...
GHSA-VH8F-65QG-3M8J Duplicate Advisory: .NET Denial of Service Vulnerability
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4vgm-c2wm-63mw. This link is maintained to preserve external references. Original Description Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service...
EUVD-2026-10696
Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally...
com.vaadin:vaadin-platform-test (10.0.10), org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 (>=01.00.02-rpm, <=01.00.03-rpm) +1 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.10)
com.vaadin:vaadin MAVEN version 10.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.10 - org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 =01.00.02-rpm,...
EUVD-2026-10694
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...
org.rapidpm:testbench-ng-m-framework-v10 (>=00.07.05-rpm, <=00.07.06-rpm), org.rapidpm:testbench-ng-m-pageobject-vaadin-v10-oss (>=00.07.05-rpm, <=00.07.06-rpm) +1 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.6)
com.vaadin:vaadin MAVEN version 10.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - org.rapidpm:testbench-ng-m-framework-v10 =00.07.05-rpm, =00.07.05-rpm, =00.07.05-rpm, =00.07.06-rpm Source cves: CVE-2026-27...
com.vaadin:vaadin-platform-test (10.0.9), org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 (>=01.00.00-rpm, <=01.00.01-rpm) +1 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.9)
com.vaadin:vaadin MAVEN version 10.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.9 - org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 =01.00.00-rpm, =01.00.00-rp...
com.vaadin:vaadin-platform-test (10.0.2), org.rapidpm.vaadin:rapidpm-vaadin-cdi-m-integration-tests (00.07.04-rpm) +4 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.2)
com.vaadin:vaadin MAVEN version 10.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.2 - org.rapidpm.vaadin:rapidpm-vaadin-cdi-m-integration-tests 00.07.04-rpm -...
CVE-2026-2742
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths. Accessing the /VAADIN endpoint without ...
CVE-2026-30964
The connected GHSA entry describes a concrete vulnerability in Webauthn Framework: when allowed_origins is configured, CheckAllowedOrigins reduces URL-like origins to their host, causing mismatched origins (scheme/port) to be treated as the same host. This bypasses the strict origin validation re...
CVE-2026-30964 Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowedorigins is configured, CheckAllowedOrigins reduces URL-like values to their host component and...
CVE-2026-30964 Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowedorigins is configured, CheckAllowedOrigins reduces URL-like values to their host component and...
CVE-2026-30964 Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowedorigins is configured, CheckAllowedOrigins reduces URL-like values to their host component and...
CVE-2026-26130
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...
CVE-2026-26127
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network...
CVE-2026-26131
Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally...
CVE-2026-26131 .NET Elevation of Privilege Vulnerability
...
