89964 matches found
PT-2026-99470
Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description An issue exists in the AutoDJ remote playlist fetch functionality within the getMediaFromRemoteUrl function. A user with station Media permissions can create or update a playlist by setting source...
CVE-2026-100862: Cleartext Storage of Sensitive Information
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...
CVE-2026-100859: Server-Side Request Forgery (SSRF)
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...
CVE-2026-101050: Improper Authentication
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
CVE-2026-100855: Missing Authorization
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
CVE-2026-100851: Exposure of Sensitive Information to an Unauthorized Actor
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...
PT-2026-99539
Name of the Vulnerable Software and Affected Versions Sylius versions prior to 2.1.16 Sylius versions prior to 2.2.9 Description Insufficient restriction of payment request actions in the Shop API endpoint allows customers to trigger refunds on completed orders. An attacker possessing order token...
PT-2026-99714
Name of the Vulnerable Software and Affected Versions Nezha Dashboard versions prior to 2.3.5 Description Authenticated users with nezha:service:write scope can submit privileged task types through the service API because the system fails to restrict service monitor task types to supported probe...
PT-2026-99717
Name of the Vulnerable Software and Affected Versions Nezha versions prior to 2.2.7 Description An information disclosure issue exists where the 'GET /api/v1/profile' endpoint returns the bcrypt-hashed password field of authenticated users. This allows attackers to extract password hashes and...
CVE-2026-100854: Missing Authorization
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...
CVE-2026-101089: Insufficiently Protected Credentials
Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...
CVE-2026-101061: Server-Side Request Forgery (SSRF)
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...
PT-2026-99479
Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.106 Description An issue exists in the 'POST /api/credentials/test' endpoint that allows collaborators with shared credential access to exfiltrate the secret of the credential owner. An attacker can override the...
CVE-2026-101086: Improper Privilege Management
Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:write scope to submit privileged task types through the service API. Attackers can deliver command execution or Agent configuration tasks to...
CVE-2026-101088: Time-of-check Time-of-use (TOCTOU) Race Condition
Nezha is a server and website monitoring tool. In versions = 2.2.11 and 2.3.1, the service sentinel worker service/singleton/servicesentinel.go contains an incomplete fix for a previously reported nil dereference denial of service GHSA-qjpp-gffx-2wm9. The 2026-07-21 fix re-validated the service...
CVE-2026-101085: Numeric Truncation Error
Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint t...
PT-2026-99713
Name of the Vulnerable Software and Affected Versions Nezha versions prior to 2.3.8 Description Authenticated non-administrator users can create malformed alert rules due to a lack of validation for alert rule types and duration bounds. By submitting a crafted alert rule via the 'POST...
PT-2026-99467
Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description A DQL injection issue exists in the AbstractSearchableListAction.php file. An attacker can inject arbitrary DQL Doctrine Query Language expressions—an object-oriented query language used by the...
PT-2026-99471
Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description Broken access control allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. By calling the 'GET /api/station/id/vue/profil...
