CVE-2022-31149

ActivityWatch open-source automated time tracker. Versions prior to 0.12.0b2 are vulnerable to DNS rebinding attacks. This vulnerability impacts everyone running ActivityWatch and gives the attacker full access to the ActivityWatch REST API. Users should upgrade to v0.12.0b2 or later to receive a patch. As a workaround, block DNS lookups that resolve to 127.0.0.1.

• CWE-290

• https://gist.github.com/zozs/fdebbce75fc8538c15851b46db944a16Exploit, Third Party Advisory
• https://github.com/ActivityWatch/activitywatch/discussions/778Release Notes, Third Party Advisory
• https://github.com/ActivityWatch/activitywatch/security/advisories/GHSA-v9fg-6g9j-h4x4Third Party Advisory
• https://gist.github.com/zozs/fdebbce75fc8538c15851b46db944a16Exploit, Third Party Advisory
• https://github.com/ActivityWatch/activitywatch/discussions/778Release Notes, Third Party Advisory
• https://github.com/ActivityWatch/activitywatch/security/advisories/GHSA-v9fg-6g9j-h4x4Third Party Advisory

Published

Sep 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31143GLPI stands for Gestionnaire Libre de Parc Informatique and …5.3
• CVE-2022-31144Redis is an in-memory database that persists on disk. A spec…8.8
• CVE-2022-31145FlyteAdmin is the control plane for Flyte responsible for ma…6.5
• CVE-2022-31146Wasmtime is a standalone runtime for WebAssembly. There is a…8.8
• CVE-2022-31147The jQuery Validation Plugin (jquery-validation) provides dr…7.5
• CVE-2022-31148Shopware is an open source e-commerce software. In versions …5.4
• CVE-2022-3115An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31150undici is an HTTP/1.1 client, written from scratch for Node.…6.5
• CVE-2022-31151Authorization headers are cleared on cross-origin redirect. …6.5
• CVE-2022-31152Synapse is an open-source Matrix homeserver written and main…7.5
• CVE-2022-31153OpenZeppelin Contracts for Cairo is a library for contract d…6.5
• CVE-2022-31154Sourcegraph is an opensource code search and navigation engi…4.3