https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T14:20:29.341691+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338331 EUVD-2026-338331 2026-10-05T14:20:29.344509+00:00 EUVD-2026-338331 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54568 fkie_cve-2026-54568 2026-10-05T14:20:29.344558+00:00

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellation-only role or object-level authorization boundary. This issue is fixed in version 3.0.6.