676374 matches found
CVE-2026-107728
The Strawberry GraphQL library (versions 0.217.0 through 0.326.1) contains a vulnerability in PermissionExtension.resolve() where synchronous field resolvers may incorrectly grant access. When a custom permission's has_permission() is a normal function returning an awaitable, the system fails to ...
CVE-2026-107728 Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve on a synchronous field resolver evaluates the result of haspermission for truthiness. When a custom permission declares haspermission as a normal function but returns an awaitable,...
EUVD-2026-95392
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve on a synchronous field resolver evaluates the result of haspermission for truthiness. When a custom permission declares haspermission as a normal function but returns an awaitable,...
cirro
Cirro es una plataforma extensible de investigación en seguridad que permite a investigadores y testers de penetración recolectar, analizar y visualizar entornos en la nube y relaciones de identidad a través de bases de datos de grafos. Construida con una arquitectura modular, Cirro puede...
javajive
JavaJive English | 简体中文 | Website A portable, pure-Go Java toolkit — extracted and trimmed from yaklang — that does three things and nothing else: Decompile — .class / .jar / .war / .zip → readable Java source. Parse classes — inspect the structure of a .class file constant pool, fields, methods,...
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...
GHSA-8WPC-H4Q6-8FXV fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...
GHSA-WW5H-9M49-7XX4 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
Summary The fix for CVE-2026-34950 CVSS 9.1, released in v6.2.0 is incomplete. It adds key.trim to the PEM-detection path in src/crypto.js, but String.prototype.trim only strips characters classified as whitespace by the ECMAScript specification. The subsequent ^-anchored regex /^-----BEGIN?: RSA...
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
Summary The fix for CVE-2026-34950 CVSS 9.1, released in v6.2.0 is incomplete. It adds key.trim to the PEM-detection path in src/crypto.js, but String.prototype.trim only strips characters classified as whitespace by the ECMAScript specification. The subsequent ^-anchored regex /^-----BEGIN?: RSA...
GHSA-687G-22H4-J4W4 fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
Summary createVerifier clockTolerance: Infinity silently bypasses both exp expiry AND nbf not-before validation. Any expired or not-yet-active token is accepted as valid. The same primitive also corrupts the verifier's internal cache so cached entries inherit infinite validity — they remain valid...
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
Summary createVerifier clockTolerance: Infinity silently bypasses both exp expiry AND nbf not-before validation. Any expired or not-yet-active token is accepted as valid. The same primitive also corrupts the verifier's internal cache so cached entries inherit infinite validity — they remain valid...
GHSA-G3JJ-5CMM-3HXX fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
Summary fast-jwt 6.2.4 silently classifies raw serialized public JWK JSON as an HMAC secret. If an application supplies public JWK JSON text as the verifier key and HS256 is explicitly allowed or automatically inferred, an attacker who knows the same public JSON text can use it as an HMAC key and...
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
Summary fast-jwt 6.2.4 silently classifies raw serialized public JWK JSON as an HMAC secret. If an application supplies public JWK JSON text as the verifier key and HS256 is explicitly allowed or automatically inferred, an attacker who knows the same public JSON text can use it as an HMAC key and...
PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure
Summary The AgentOS server in the praisonai TypeScript/npm package ships an insecure default: it binds 0.0.0.0, sets no API key, and uses CORS with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart new AgentOSagents:....serveport...
GHSA-6WJP-V33H-5CVQ PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure
Summary The AgentOS server in the praisonai TypeScript/npm package ships an insecure default: it binds 0.0.0.0, sets no API key, and uses CORS with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart new AgentOSagents:....serveport...
domdig
DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...
PraisonAI: Shell command allowlist bypass via find -exec built-in action
Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj utility-tools shell chaining and GHSA-vjv9-7m7j-h833 SandboxExecutor chaining can be bypassed via find's built-in -exec action. The fix blocks shell metacharacters ;|& + The ...
GHSA-CV3G-HJ65-PCFH PraisonAI: Shell command allowlist bypass via find -exec built-in action
Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj utility-tools shell chaining and GHSA-vjv9-7m7j-h833 SandboxExecutor chaining can be bypassed via find's built-in -exec action. The fix blocks shell metacharacters ;|& + The ...
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...
GHSA-HC5V-GXVJ-58WH PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...