https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 06:14:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-236613 EUVD-2026-236613 https://cve.radiocsirt.org/vuln/euvd-2026-236613 https://cve.radiocsirt.org/vuln/fkie_cve-2025-46332 <p>Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1 and prior as certain circumstances allows a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint (.well-known/vercel/flags). This vulnerability allows for information disclosure, where a bad actor could gain access to a list of all feature flags exposed through the flags discovery endpoint, including the flag names, flag descriptions, available options and their labels (e.g. true, false), and default flag values. This issue has been patched in flags@4.0.0, users of flags and @vercel/flags should also migrate to flags@4.0.0.</p> <p>Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1 and prior as certain circumstances allows a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint (.well-known/vercel/flags). This vulnerability allows for information disclosure, where a bad actor could gain access to a list of all feature flags exposed through the flags discovery endpoint, including the flag names, flag descriptions, available options and their labels (e.g. true, false), and default flag values. This issue has been patched in flags@4.0.0, users of flags and @vercel/flags should also migrate to flags@4.0.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-46332 https://cve.radiocsirt.org/vuln/ghsa-892p-pqrr-hxqr <p><strong>Affected:</strong> npm: flags, npm: @vercel/flags</p> <p>## Summary</p> <p>An information disclosure vulnerability affecting Flags SDK has been addressed. It impacted `flags` ≤3.2.0 and `@vercel/flags` ≤3.1.1 and in certain circumstances, allowed a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint (`.well-known/vercel/flags`).</p> <p>## Impact</p> <p>This vulnerability allowed for information disclosure, where a bad actor could gain access to a list of all feature flags exposed through the flags discovery endpoint, including the:</p> <p>- Flag names - Flag descriptions - Available options and their labels (e.g. `true`, `false`) - Default flag values</p> <p>Not impacted:</p> <p>- Flags providers were not accessible</p> <p>No write access nor additional customer data was exposed, this is limited to just the values noted above. Vercel has automatically mitigated this incident on behalf of our customers for the default flags discovery endpoint at `.well-known/vercel/flags`. Flags Explorer will be disabled and show a warning notice until upgraded to `flags@4.0.0`.</p> <p>## Resolution</p> <p>The `verifyAccess` function was patched within `flags@4.0.0`.</p> <p>Users of `@vercel/flags` should also migrate to `flags@4.0.0`.</p> <p>For further guidance on upgrading your version, please see our [upgrade guide](https://github.com/vercel/flags/blob/main/packages/flags/guides/upgrade-to-v4.md).</p> <p>## Mitigations</p> <p>Vercel implemented a network-level mitigation to prevent the default flags discovery endpoint at `/.well-known/vercel/flags` being reac…</p> <p><strong>Affected:</strong> npm: flags, npm: @vercel/flags</p> <p>## Summary</p> <p>An information disclosure vulnerability affecting Flags SDK has been addressed. It impacted `flags` ≤3.2.0 and `@vercel/flags` ≤3.1.1 and in certain circumstances, allowed a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint (`.well-known/vercel/flags`).</p> <p>## Impact</p> <p>This vulnerability allowed for information disclosure, where a bad actor could gain access to a list of all feature flags exposed through the flags discovery endpoint, including the:</p> <p>- Flag names - Flag descriptions - Available options and their labels (e.g. `true`, `false`) - Default flag values</p> <p>Not impacted:</p> <p>- Flags providers were not accessible</p> <p>No write access nor additional customer data was exposed, this is limited to just the values noted above. Vercel has automatically mitigated this incident on behalf of our customers for the default flags discovery endpoint at `.well-known/vercel/flags`. Flags Explorer will be disabled and show a warning notice until upgraded to `flags@4.0.0`.</p> <p>## Resolution</p> <p>The `verifyAccess` function was patched within `flags@4.0.0`.</p> <p>Users of `@vercel/flags` should also migrate to `flags@4.0.0`.</p> <p>For further guidance on upgrading your version, please see our [upgrade guide](https://github.com/vercel/flags/blob/main/packages/flags/guides/upgrade-to-v4.md).</p> <p>## Mitigations</p> <p>Vercel implemented a network-level mitigation to prevent the default flags discovery endpoint at `/.well-known/vercel/flags` being reac…</p> https://cve.radiocsirt.org/vuln/ghsa-892p-pqrr-hxqr https://cve.radiocsirt.org/vuln/msrc_cve-2025-46332 msrc_CVE-2025-46332 https://cve.radiocsirt.org/vuln/msrc_cve-2025-46332