GHSA-PHG3-3G28-WQ9V Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Summary Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF login CSRF / account fixation. The vulnerable code clears the session oauthstate value to the empty string "" after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then...

CVE-2026-61687 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...

CVE-2026-61687 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...

CVE-2026-61687 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...

CVE-2026-61687

Hatchet , a platform for orchestrating background tasks, AI agents, and durable workflows, contains an unauthenticated OAuth state CSRF / login-CSRF vulnerability in its ValidateOAuthState function (prior to 0.91.1 ). After a successful OAuth callback, the function clears the oauth_state_ session...

EUVD-2026-83978

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...

Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by vulnerabilities in glibc 2.34, netty-codec-http 4.1.x, ncurses 6.2, and net/http

Summary glibc, netty-codec-http, ncurses, and net/http are bundled with IBM Optim as OS base image and application runtime dependencies. CVE-2026-0861 is an integer overflow in glibc that may cause heap corruption; CVE-2025-58056 is an HTTP request smuggling flaw in Netty; CVE-2022-29458 is an...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

CVE-2025-71421

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

CVE-2025-71419

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLEAGENT can inject malicious script into the identifier field, which is persisted and executed wh...

USN-8790-1 expat vulnerabilities

It was discovered that Expat could be made to allocate large amounts of memory when parsing a small crafted document. An attacker could possibly use this issue to cause Expat to consume resources, leading to a denial of service. This issue was only addressed in Ubuntu 24.04 LTS. CVE-2025-59375 It...

USN-8790-1: Expat vulnerabilities

It was discovered that Expat could be made to allocate large amounts of memory when parsing a small crafted document. An attacker could possibly use this issue to cause Expat to consume resources, leading to a denial of service. This issue was only addressed in Ubuntu 24.04 LTS. CVE-2025-59375 It...

CVE-2025-71421 UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

EUVD-2025-210977

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

CVE-2025-71421

UVdesk core-framework versions before 1.1.7 contain an improper privilege management vulnerability in the editAgent endpoint. An agent with existing agent-management privilege can submit their own account identifier with the role parameter set to ROLE_ADMIN, escalating their own role to administr...

CVE-2025-71421 UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

CVE-2025-71421 UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

EUVD-2025-210975

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLEAGENT can inject malicious script into the identifier field, which is persisted and executed wh...

CVE-2025-71419 UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLEAGENT can inject malicious script into the identifier field, which is persisted and executed wh...

CVE-2025-71419 UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLEAGENT can inject malicious script into the identifier field, which is persisted and executed wh...