Exposure Of Sensitive Information

auth0/symfony is vulnerable to Exposure of Sensitive Information. The vulnerability is due to accepting OAuth 2.0 bearer access tokens through URL query parameters in addition to the Authorization header, which allows an attacker to capture and replay exposed access tokens against protected API...

CVE-2026-62208

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's...

CVE-2026-62387 Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin

The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: as its default CORS configuration on all responses, including authenticated endpoints and preflight OPTIONS responses. Because the plugin accepts credentials via the Authorization and X-API-Token...

CVE-2026-62387

CVE-2026-62387 affects Grav’s API plugin (getgrav/grav-plugin-api) prior to 1.0.0-rc.16. The vulnerability arises from a default CORS setting of Access-Control-Allow-Origin: * on all responses, including authenticated endpoints and preflight (OPTIONS). The plugin accepts credentials via Authoriza...

CVE-2026-62208

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's...

CVE-2026-62208

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's...

EUVD-2026-45096

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's...

PT-2026-60817

Name of the Vulnerable Software and Affected Versions HCL DevOps Loop affected versions not specified Description The software is affected by missing HTTP security headers. This omission may reduce browser protections against common web-based attacks, including clickjacking an attack that tricks...

CVE-2026-44974: Interpretation Conflict

@hapi/content provided HTTP Content- headers parsing. Prior to 6.0.2, Content.disposition retained the last occurrence of each duplicate parameter while Content.type retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another...

CVE-2026-21762: Improper Neutralization of HTTP Headers for Scripting Syntax

HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting...

CVE-2026-8859: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest component. A path traversal vulnerability exists when the "Save to File" feature is enabled, where filenames extracted from HT...

PT-2026-60868

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Improper input validation in the APIRequest component allows an attacker to write arbitrary files to unintended locations. This occurs when the Save to File feature is enabled, as...

PT-2026-60896

Name of the Vulnerable Software and Affected Versions meta-ads-mcp versions prior to 1.0.115 Description An authentication bypass exists in the AuthInjectionMiddleware within the meta-ads-mcp package. The middleware only rejects requests when both auth token and pipeboard token are absent. Howeve...

CVE-2026-54465: Allocation of Resources Without Limits or Throttling

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a TCP server using WebSocket::Driver.server or to complement a WebSocket client, a peer can make a single connection consume an unbounded...

CVE-2026-54171: Insertion of Sensitive Information Into Sent Data

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial...

CVE-2026-50274: Allocation of Resources Without Limits or Throttling

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or...

CVE-2026-62208: Insufficiently Protected Credentials

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's...

PT-2026-60618

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's...

PT-2026-60899

Name of the Vulnerable Software and Affected Versions PocketSphinx versions 5prealpha through 5.1.0 Description The trie language model code fails to check boundary conditions when reading headers of ARPA, DMP, and binary format language model files, which can lead to stack and heap buffer...

CVE-2026-50271: Allocation of Resources Without Limits or Throttling

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES limits on the extract path. A remote, unauthenticated...