https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 02:41:00 +0000 https://cve.radiocsirt.org/vuln/cve-2026-42300 <p><strong>Affected:</strong> l3montree-dev devguard</p> <p>DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user&#39;s Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation&#39;s DevGuard resources. This vulnerability is fixed in 1.2.2.</p> <p><strong>Affected:</strong> l3montree-dev devguard</p> <p>DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user&#39;s Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation&#39;s DevGuard resources. This vulnerability is fixed in 1.2.2.</p> https://cve.radiocsirt.org/vuln/cve-2026-42300