Issues · github/advisory-database · GitHub

Labels Milestones New issue

[New Advisory] Hardcoded MyCupra OAuth client_secret, JWT signature bypass, and plaintext token storage in WeConnect-python (PyPI: weconnect)

#7310

· AidanDalyAus opened

on Apr 5, 2026

[New Advisory] Hardcoded API Key, OAuth Credentials, and Defeated PKCE in mytoyota (PyPI)

#7309

· AidanDalyAus opened

on Apr 5, 2026

[New Advisory] pyporscheconnectapi — Missing PKCE, static OAuth state, and credential exposure (CWE-352, CWE-732)

#7308

· AidanDalyAus opened

on Apr 5, 2026

Hardcoded RSA private key enables user password decryption in PyMammotion

#7307

· AidanDalyAus opened

on Apr 5, 2026

Weak PRNG (Math.random) for PKCE code verifiers in ioBroker.vw-connect

#7306

· AidanDalyAus opened

on Apr 5, 2026

https://github.com/ardevd/jlrpy/security/advisories/new

#7305

· AidanDalyAus opened

on Apr 5, 2026

[New Advisory] connected-car npm package — Broken PKCE + VIN Injection (CWE-303, CWE-20)

#7304

· AidanDalyAus opened

on Apr 5, 2026

CVE Request: Cross-Site Scripting via isOn() bypass in Vue.js 3.x SSR (GHSA-5w45-w79q-rpqq)

#7300

· sgInnora opened

on Apr 4, 2026

CVE Request: Remote Code Execution in Vue.js 3.x SSR Runtime Compiler (GHSA-pw74-q32p-x99f)

#7299

· sgInnora opened

on Apr 4, 2026

Add " DISPUTED " to GHSA-6f39-fvhf-c6qr advisory

#7296

· jasnow opened

on Apr 3, 2026

GHSA-5f7q-jpqc-wp7h: OSV export missing fixed events for 15.x canary ranges, causing false positives

#7295

· nesl247 opened

on Apr 3, 2026

[npm] fastmcp: Unbounded HTTP Body in Streamable HTTP Transport (CWE-770)

#7292

· razashariff opened

on Apr 3, 2026