CVE-2026-81027: Missing Authorization

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the...

CVE-2026-55539

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API createapp function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAIJOBSAPIKEY middleware f...

CVE-2026-55533

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, createauthmiddleware allows requests when auth=api-key lacks PRAISONAIAPIKEY or JWT authentication lacks PRAISONAIJWTSECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests...

CVE-2026-73423

A flaw was found in Astro. The composable astro/hono pipeline can bypass origin checks, which are designed to prevent unauthorized cross-site requests. This occurs because the security.checkOrigin mechanism is not consistently applied when middleware is absent or misordered in the pipeline. A...

GHSA-R7V3-X45F-G7HP PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

Summary praisonai serve agents exposes HTTP routes that invoke registered agents. The CLI advertises --api-key with help text "API key for authentication", parses it, and forwards it into ServeHandler. But createagentsapp never reads config"apikey" again and installs no auth dependency or...

CVE-2026-79665

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...

CVE-2026-79658

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The...

EUVD-2026-65449

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...

CVE-2026-79665

Ech0 before 4.5.1 is affected by an authorization bypass vulnerability. The root cause is that session tokens skip scope validation in the RequireScopes middleware , enabling logged-in non-admin users to access admin endpoints. An attacker with a valid low-privilege session token can read system ...

CVE-2026-79665 Ech0 before 4.5.1 Authorization Bypass via Session Tokens

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...

CVE-2026-79665 Ech0 before 4.5.1 Authorization Bypass via Session Tokens

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...

CVE-2026-79665

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...

EUVD-2026-65456

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The...

CVE-2026-79658

Ech0 versions before 5.0.1 are vulnerable to a denial-of-service attack via the Accept-Language header. The i18n middleware, which runs on every HTTP request, passes the header unfiltered to golang.org/x/text/language.ParseAcceptLanguage. A gap in the CVE-2022-32149 mitigation caps - characters b...

CVE-2026-79658

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The...

CVE-2026-79658 Ech0 before 5.0.1 Denial of Service via Accept-Language

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The...

CVE-2026-79658: Uncontrolled Resource Consumption

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The...

PT-2026-81284

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...

CLSA-2026-1787602147 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.5-tuxcare.1...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through getFilenameFromUrl in src/middleware.js. An attacker can read files outside the configured output directory by sending a request whose path shares a publicPath prefix without actually being under it, such as...