91911 matches found
CVE-2026-70618
Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/guildid/roles/roleid/member-ids endpoint without guild membership verification. Attackers can exploit the...
CVE-2026-66885
Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...
CVE-2026-70618 Spacebar Server Missing Authorization via member-ids Endpoint
Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/guildid/roles/roleid/member-ids endpoint without guild membership verification. Attackers can exploit the...
CVE-2026-70618
Spacebar Server (before commit 51da17c) contains a missing authorization vulnerability in the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint. The unprotected route handler lacks permission checks present in sibling endpoints, allowing any authenticated user with a valid bearer token a...
CVE-2026-70617 Spacebar Server Missing Authorization via Group DM Recipient Endpoint
Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the...
CVE-2026-70617 Spacebar Server Missing Authorization via Group DM Recipient Endpoint
Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the...
EEF-CVE-2026-66885 Livebook Teams identity callback lacks state binding, allowing login CSRF
Summary Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4...
CVE-2026-66885
Livebook CVE-2026-66885 is a CSRF weakness in the Livebook Teams identity callback. When configured for Livebook Teams, the OAuth-style callback does not bind to the initiating browser session (no state/nonce, auth request body empty). The code parameter is exchanged for an access token and writt...
CVE-2026-66885 Livebook Teams identity callback lacks state binding, allowing login CSRF
Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...
CGA-6G9J-X832-M5M5
Bulletin has no description...
CGA-J246-H49J-3FRR
Bulletin has no description...
CGA-M2C5-GG88-9HP4
Bulletin has no description...
CGA-6Q5G-H7M6-46P7
Bulletin has no description...
CGA-W5JC-JWM7-G95M
Bulletin has no description...
CGA-9M2X-GF9V-58F3
Bulletin has no description...
CGA-XQR6-2HHM-5Q86
Bulletin has no description...
CGA-V3MW-9C24-RX46
Bulletin has no description...
CGA-57VG-22M7-XXH3
Bulletin has no description...