115031 matches found
CVE-2026-112037 diem-project diem Google Analytics Client gapi.class.php certificate validation
A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The...
CVE-2026-112037 diem-project diem Google Analytics Client gapi.class.php certificate validation
A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The...
EUVD-2026-104032
A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The...
CVE-2026-112037: Improper Certificate Validation
A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The...
CVE-2026-103091: Missing Authorization
Missing Authorization CWE-862 and Initialization of a Resource with an Insecure Default CWE-1188 in the MCP proxy HandleStreamPassThrough in mcpservice.go and OIDC registration flow GET /info and POST /register in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1...
PT-2026-117210
Name of the Vulnerable Software and Affected Versions Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.8 Description Missing authorization and the use of insecure default resource initialization allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools...
PT-2026-117209
Name of the Vulnerable Software and Affected Versions Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 Description Missing authentication and authorization in the /libp2p-http ingress server, specifically within the StartIngressServer function in cmd/sam-node/node.go, allow ...
CVE-2026-102503: Missing Authentication for Critical Function
Missing Authentication for Critical Function CWE-306 and Missing Authorization CWE-862 in the /libp2p-http ingress server StartIngressServer in cmd/sam-node/node.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass...
Security update for google-osconfig-agent (important)
openSUSE security update: security update for google-osconfig-agent ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22078-1 Rating: important References: bsc1283672 Cross-References: CVE-2026-63209 CVSS scores: CVE-2026-63209 SUSE : 7.5...
CVE-2026-111639
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/googleonetap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...
CVE-2026-111639 bbs-go through 4.4.6 Account Takeover via Google One Tap Login
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/googleonetap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...
EUVD-2026-103061
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/googleonetap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...
CVE-2026-111639
The bbs-go application (through version 4.4.6 ) contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint. The root cause is a failure to verify the aud claim in Google-signed ID tokens, allowing remote attackers to replay tokens issued to any OAuth client. By usin...
CVE-2026-111639 bbs-go through 4.4.6 Account Takeover via Google One Tap Login
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/googleonetap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...
CVE-2026-111639
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/googleonetap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...
SUSE CVE-2026-110913
Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
SUSE CVE-2026-110914
Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
SUSE CVE-2026-110915
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
SUSE CVE-2026-110916
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...