CVE-2026-120474

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original...

CVE-2026-116592

The undici HTTP client for Node.js is vulnerable to cache poisoning and cross-user disclosure in versions 7.30.1 and 8.12.2 through 8.12.3 . When an originless Agent uses both redirect and shared cache interceptors, the software incorrectly inspects only the final redirect hop to determine if a r...

UBUNTU-CVE-2026-120474

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original...

Malicious code in @goparrot-dashboard/franchise-management (npm)

@goparrot-dashboard/franchise-management is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

MAL-2026-18510 Malicious code in @goparrot-dashboard/settings (npm)

@goparrot-dashboard/settings is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

MAL-2026-18499 Malicious code in @goparrot-dashboard/franchise-management (npm)

@goparrot-dashboard/franchise-management is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

MAL-2026-18493 Malicious code in @goparrot-dashboard/analytics (npm)

@goparrot-dashboard/analytics is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/franchise-menu-settings (npm)

@goparrot-dashboard/franchise-menu-settings is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same...

CVE-2026-62277

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied...

CVE-2026-62277 LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied...

CVE-2026-62277

The open-source web-based vehicle maintenance tracker LubeLogger (prior to version 1.6.8 ) contains an Insecure Direct Object Reference (IDOR) vulnerability in the PrintRecordStickers function within /Controllers/VehicleController.cs. While the system verifies that an authenticated caller can vie...

CVE-2026-62277 LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied...

CVE-2026-62277 LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied...

EUVD-2026-114565

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied...

PT-2026-134232

Name of the Vulnerable Software and Affected Versions LubeLogger versions prior to 1.6.8 Description An authenticated user can cause cross-user disclosure of vehicle maintenance records. The PrintRecordStickers function in /Controllers/VehicleController.cs verifies if the caller can view the...

CVE-2026-62277: hargata lubelog: LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied...

Undici Vulnerable To Cache Poisoning And Cross-user Disclosure Via Cross-origin Redirects

Impact When an originless "Agent" composes the redirect and cache interceptors as "composeredirect, cache" with a shared cache "type: 'shared'", the cache builds its key from the original request URL before the redirect handler changes the origin. The response produced after a redirect is then...

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

Impact When an originless Agent composes the redirect and cache interceptors as composeredirect, cache with a shared cache type: 'shared', the cache builds its key from the original request URL before the redirect handler changes the origin. The response produced after a redirect is then stored...

npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects vulnerability discovered by ? in WordPress npm undici versions = 7.0.0, 7.30.1...

CVE-2026-109829 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...