CVE-2026-105098 Omega Solution CoinEx Crypto Support Ticket API customer information disclosure

A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support Ticket API. The manipulation of the argument status/page/count results in information disclosure. The attack can be executed remotely. Th...

MStore API <= 3.9.2 - Authentication Bypass

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers ...

Ray < 2.52.0 - Remote Code Execution

Ray versions prior to 2.52.0 allow unauthenticated remote code execution via the job submission API at /api/jobs/. A weak User-Agent heuristic rejecting Mozilla-prefixed headers can be bypassed by non-browser clients, enabling arbitrary command execution when the dashboard is network-reachable. i...

SimpleHelp <= 5.5.7 - Privilege Escalation

SimpleHelp remote support software v5.5.7 and before contains a privilege escalation caused by insufficient access controls in API key creation, letting low-privileges technicians escalate privileges to server admin, exploit requires low-privileges technician access. id: CVE-2024-57726 info: name...

JumpServer > 3.6.4 - Information Disclosure

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...

OpenMetadata - Authentication Bypass

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The JwtFilter handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request...

HTML Email Template Designer < 3.1 - Missing Authorization on Rest Route

The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the /includes/class-template-designer.php file, in versions up to...

reverse-ip-new-api

reverse-ip-new-api 이 도구는 역방향 IP 조회를 수행하는 데 사용됩니다— 하나의 IP 주소에 호스팅된 모든 도메인을 검색합니다. 기능 멀티스레딩 처리 API 기반 처리 오류 처리 스레드 수 사용자 지정 커피 사주기 : 비트코인 $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC 실행 방법? 1. 공식 Python 웹사이트에서 Python을 다운로드하여 설치합니다: https://www.python.org. 2. 다음 명령을 사용하여 필요한 모듈을 설치합니다: pip install requests...

CVE-2026-105131

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

CVE-2026-105096

A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypass. The attack may be launched remotely. The exploit has be...

CVE-2024-0368

CVE-2024-0368 Hustle 플러그인 = 7.8.3은 inc/providers/hubspot/hustle-hubspot-api.php에 하드코딩된 HubSpot API 자격 증명을 포함하고 있습니다. 취약점 요약 필드| 값 ---|--- CVE ID| CVE-2024-0368 제목| Hustle = 7.8.3 - 노출된 HubSpot API 키를 통한 민감 정보 노출 CVSS 점수| 8.6 높음 영향받는 플러그인| Hustle - 이메일 마케팅, 리드 생성, 옵트인, 팝업 wordpress-popup 취약한 버전| =...

CVE-2023-23752

CVE-2023-23752 Joomla! 무단 액세스 취약점 POC: /api/index.php/v1/config/application?public=true 취약점 분석 https://xz.aliyun.com/t/12175...

CVE-2026-105097 Omega Solution CoinEx Crypto Customer Information API customer-currency authorization

A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-105097

A vulnerability exists in the Customer Information API of Omega Solution CoinEx Crypto 2025 . The issue resides in an unknown function within the /customer-currency/ file, where manipulating the ID argument results in an authorization bypass . Remote exploitation is possible, and a public exploit...

EUVD-2026-92063

A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-105131

The mayswind ezBookkeeping software (versions 1.2.0 before 2.0.1) is vulnerable to a privilege escalation flaw in the /api/v1/tokens/refresh.json endpoint. The root cause is that the TokenRefreshHandler fails to verify the token type, allowing an attacker with an API token to exchange it for a 30...

EUVD-2026-92060

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

CVE-2026-105131 mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

CVE-2026-105131 mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...

CVE-2026-85706

CVE-2026-85706: GitLab CE/EE の未認証任意ローカルファイル読み取り CVE-2026-85706 は、GitLab CE/EE の Repository Commits API および Repository Files API における重大なパストラバーサル / 認証欠如の問題です。未認証の攻撃者がサーバーに任意のファイルを読み取らせ、その内容をエラーチャネル経由で取得できます。CVSS 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N。 GitLab の公式タイトルは 「Path Traversal...