29379 matches found
EUVD-2026-80738
A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXTMESSAGESTART causes origin validation error. Remote exploitation of the...
CVE-2026-92360
A medium-severity vulnerability (CVSS 3.1: 6.3 ) exists in ag-ui-protocol ag-ui 1.0 , specifically in the Event Application Layer component. The vulnerable element is the prepareRunAgentInput function in agent/agent.ts , where manipulation of the TEXT_MESSAGE_START argument triggers an origin val...
CVE-2026-92360 ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation
A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXTMESSAGESTART causes origin validation error. Remote exploitation of the...
CVE-2026-92360 ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation
A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXTMESSAGESTART causes origin validation error. Remote exploitation of the...
Origin Validation Error
Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Origin Validation Error in the idtoken validation. An attacker can gain unauthorized access by presenting a valid token issued for a...
CVE-2026-64684: Exposure of Sensitive Information to an Unauthorized Actor
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamablehttpclient.rs builds its defaulthttpclient with reqwest's automatic redirect policy and applies caller-supplied values...
PT-2026-93889
Impact The SSE client→server POST endpoints are @csrf exempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL which creates and mounts a LiveView as the victim and PO...
CVE-2026-77119: Origin Validation Error
A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through...
CVE-2026-77119: Origin Validation Error
A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through...
CVE-2026-61593: Cross-Site Request Forgery (CSRF)
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a...
CVE-2026-86466: Origin Validation Error
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...
CVE-2026-75025: Origin Validation Error
Mattermost Desktop App versions =6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy...
CVE-2026-92360: Origin Validation Error
A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXTMESSAGESTART causes origin validation error. Remote exploitation of the...
PT-2026-94090
Name of the Vulnerable Software and Affected Versions rmcp versions prior to 2.1.0 Description The StreamableHttpClientTransport in the rmcp crate fails to mark caller-supplied custom HTTP headers as sensitive and uses a default HTTP client with an automatic redirect policy. When a compromised or...
PT-2026-93714
Name of the Vulnerable Software and Affected Versions ag-ui-protocol ag-ui version 1.0 Description A weakness in the Event Application Layer component allows remote exploitation. The issue occurs within the prepareRunAgentInput function located in the agent/agent.ts file, where manipulation of th...
CVE-2026-91740
A flaw was found in Skia, a 2D graphics library used in Google Chrome. This vulnerability, stemming from an uninitialized resource, allows a remote attacker to obtain sensitive cross-origin data. By crafting a malicious HTML page, an attacker can trick a user into visiting it, leading to the...
CVE-2026-91747
A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit a use-after-free vulnerability by crafting a malicious HTML page. This could allow the attacker to obtain sensitive cross-origin data...
CVE-2026-91730
An incomplete cleanup flaw was found in the GetUserMedia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=543640868...
