67201 matches found
CVE-2026-71214
CVE-2026-71214 (NASA-AMMOS plandev sequencing-server) : The authorization middleware in sequencing-server derives the caller’s Hasura session role via getHasuraSession(), preferring a client-supplied session_variables object from the request body over JWT claims in the Authorization header, witho...
CVE-2026-71214 NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server
The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...
CVE-2026-71207 Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass
The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded...
CVE-2026-71206
Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or...
EUVD-2026-53203
Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or...
MAL-2026-12108 Malicious code in alipclutch-baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bda065ae67b5aebf16879c88d3aa76bdea7775254fc5237ae10b1a67db67c3e This Baileys fork modifies the outgoing WhatsApp rich-media send path in lib/Socket/messages-send.js so that every image and video preview payload...
Malicious code in alipclutch-baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bda065ae67b5aebf16879c88d3aa76bdea7775254fc5237ae10b1a67db67c3e This Baileys fork modifies the outgoing WhatsApp rich-media send path in lib/Socket/messages-send.js so that every image and video preview payload...
CVE-2026-67592
Removed by vendor...
EUVD-2026-53089
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...
CVE-2026-67591
An authenticated attacker can exploit a flaw in Apache Qpid ProtonJ2 (versions through 1.1.0 ) by exceeding the session flow control incoming window . This vulnerability can lead to a denial of service (DoS) , rendering the system unavailable to legitimate users. To remediate this issue, users ar...
CVE-2026-67591
Removed by vendor...
CVE-2026-67591
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...
CVE-2026-67591
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...
CVE-2026-67591 Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...
CVE-2026-67591 Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...
CVE-2026-67591 Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...
CVE-2026-67553 Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...
CVE-2026-67553 Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...
CVE-2026-67553
The Apache Qpid Proton-Dotnet library (versions through 1.0.0 ) is vulnerable to a resource exhaustion issue where an authenticated attacker can exceed the session flow control incoming window . This flaw could potentially lead to a denial of service (DoS) . To remediate this vulnerability, users...
CVE-2026-67553
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...