All CVEs — page 36 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
A heap-based buffer overflow (CWE-122) exists in Xbox systems, allowing remote code execution without authentication due to insufficient input validation over the network. The CVSS 9.8 score indicates maximum impact across confidentiality, integrity, and availability.
In HarnessRouter versions prior to 0.31.8, non-self-hosted deployments incorrectly attach the server's internal authorization key to requests before validating the provided bearer token, and certain API routes trust this key to derive organization context from the URL. This allows unauthenticated attackers to forge requests that impersonate any organization and modify provider connections, leading to credential theft and injection of malicious responses into agent workflows.