https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T14:15:32.223359+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-73424 CVE-2026-73424 — Astro: Unauthenticated path override in the @astrojs/vercel ISR function 2026-10-07T14:15:32.242152+00:00

Affected: withastro astro

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.