| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. |
| Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider.
To remediate this issue, users should upgrade to version 1.6.0 and configure the expected token audience or client ID for the server. |
| Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification. |
| A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic. |
| A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1. |
| Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process. |
| The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user's cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version
Vaadin 14.14.0 - 14.14.7
Vaadin 23.6.0 - 23.6.16
Vaadin 24.4.0 - 24.4.25
Vaadin 24.5.0 - 24.5.15
Vaadin 24.6.0 - 24.6.13
Vaadin 24.7.0 - 24.7.16
Vaadin 24.8.0 - 24.8.17
Vaadin 24.9.0 - 24.9.23
Vaadin 24.10.0 - 24.10.11
Vaadin 25.0.0 - 25.0.13
Vaadin 25.1.0 - 25.1.13
Vaadin 25.2.0 - 25.2.10
Vaadin 25.3.0 - 25.3.2
Vaadin Framework 7.1.0 - 7.7.54
Vaadin Framework 8.0.0 - 8.32.1
Mitigation
Upgrade to 14.14.8
Upgrade to 23.6.17
Upgrade to 24.4.26
Upgrade to 24.7.17
Upgrade to 24.7.17
Upgrade to 24.7.17
Upgrade to 24.9.24
Upgrade to 24.9.24
Upgrade to 24.10.12
Upgrade to 25.2.11
Upgrade to 25.2.11
Upgrade to 25.2.11
Upgrade to 25.3.3
Upgrade to 7.7.55
Upgrade to 8.32.2
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
Artifacts under com.vaadin
Maven coordinates / Vulnerable versions / Fixed version
vaadin / 14.14.0 - 14.14.7 / >=14.14.8
vaadin / 23.6.0 - 23.6.16 / >=23.6.17
vaadin / 24.4.0 - 24.4.25 / >=24.4.26
vaadin / 24.5.0 - 24.5.15 / >=24.7.17
vaadin / 24.6.0 - 24.6.13 / >=24.7.17
vaadin / 24.7.0 - 24.7.16 / >=24.7.17
vaadin / 24.8.0 - 24.8.17 / >=24.9.24
vaadin / 24.9.0 - 24.9.23 / >=24.9.24
vaadin / 24.10.0 - 24.10.11 / >=24.10.12
vaadin / 25.0.0 - 25.0.13 / >=25.2.11
vaadin / 25.1.0 - 25.1.13 / >=25.2.11
vaadin / 25.2.0 - 25.2.10 / >=25.2.11
vaadin / 25.3.0 - 25.3.2 / >=25.3.3
vaadin-core / 14.14.0 - 14.14.7 / >=14.14.8
vaadin-core / 23.6.0 - 23.6.16 / >=23.6.17
vaadin-core / 24.4.0 - 24.4.25 / >=24.4.26
vaadin-core / 24.5.0 - 24.5.15 / >=24.7.17
vaadin-core / 24.6.0 - 24.6.13 / >=24.7.17
vaadin-core / 24.7.0 - 24.7.16 / >=24.7.17
vaadin-core / 24.8.0 - 24.8.17 / >=24.9.24
vaadin-core / 24.9.0 - 24.9.23 / >=24.9.24
vaadin-core / 24.10.0 - 24.10.11 / >=24.10.12
vaadin-core / 25.0.0 - 25.0.13 / >=25.2.11
vaadin-core / 25.1.0 - 25.1.13 / >=25.2.11
vaadin-core / 25.2.0 - 25.2.10 / >=25.2.11
vaadin-core / 25.3.0 - 25.3.2 / >=25.3.3
flow-server / 2.13.0 - 2.13.7 / >=2.13.8
flow-server / 23.6.0 - 23.6.15 / >=23.6.16
flow-server / 24.4.0 - 24.4.18 / >=24.4.19
flow-server / 24.5.0 - 24.5.17 / >=24.7.17
flow-server / 24.6.0 - 24.6.14 / >=24.7.17
flow-server / 24.7.0 - 24.7.15 / >=24.7.16
flow-server / 24.8.0 - 24.8.16 / >=24.9.24
flow-server / 24.9.0 - 24.9.28 / >=24.9.29
flow-server / 24.10.0 - 24.10.14 / >=24.10.15
flow-server / 25.0.0 - 25.0.15 / >=25.2.11
flow-server / 25.1.0 - 25.1.18 / >=25.1.19
flow-server / 25.2.0 - 25.2.12 / >=25.2.13
flow-server / 25.3.0 - 25.3.3 / >=25.3.4
vaadin-server / 7.1.0 - 7.7.54 / >=7.7.55
vaadin-server / 8.0.0 - 8.32.1 / >=8.32.2
vaadin-server-mpr-jakarta / 7.7.36 - 7.7.54 / >=7.7.55
vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2 |
| Origin Validation Error Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V. |
| Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). |
| Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. |
| A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of the argument _name_or_path leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. |
| BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders. |
| FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid. |
| Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the query string. The alternate application uses the same configuration, environment, datasource and debug settings: this is not an authentication bypass or data/debug escalation. It can bypass maintenance mode enabled only at runtime, provide a second set of in-memory rate-limit counters, and trigger additional application-startup side effects and memory use. This is fixed in 4.2.0. |
| The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 in src/jwk/jose_jwk_kty_ec.erl splits the raw signature in half by its actual byte length (split_binary(Signature, byte_size(Signature) div 2)) instead of enforcing the fixed length required by RFC 7518 §3.4, and then decodes each half with crypto:bytes_to_integer/1, which ignores leading zero bytes.
As a result, an attacker who holds one valid token can prepend leading zero bytes to each of the R and S halves to produce longer signatures that still split evenly and decode to the same (r, s) pair, so many distinct signature byte strings all verify against the same key (signature malleability). This does not allow forging new payloads or impersonating a signer, because the underlying (r, s) values are unchanged. It does defeat any security control that assumes a valid token or its signature is unique, such as token-revocation-by-hash, replay or idempotency caches, and deduplication logic.
This issue affects jose: from 1.0.0 before 1.11.13. |
| Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. |
| gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were. |
| Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2. |
| Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state that initiated the login. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is fixed in version 6.2.0. |
