CVE-2026-86426

LibreNMS before 26.8.0 contains an authentication bypass in its REST API caused by MySQL type coercion : unauthenticated attackers can send small integers (0–9) instead of string tokens, allowing them to match token hashes and access protected endpoints. Successful exploitation exposes device cre...

EUVD-2026-72384

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

CVE-2026-86426 LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

CVE-2026-86426 LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

CVE-2026-86426 LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

CVE-2026-86417

MISP (the open-source threat-intelligence sharing platform) contained an inconsistent email-visibility enforcement in DashboardsController::listTemplates() . The query always fetched User.email , but redaction was applied only in the non-REST (HTML) rendering branch. An authenticated user who saw...

CVE-2026-86417 MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

CVE-2026-86417 MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

EUVD-2026-72360

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

CVE-2026-86417 MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

WordPress Ninja Forms - Scheduled Exports plugin <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters vulnerability

WordPress Ninja Forms - Scheduled Exports plugin = 3.0.3 - Authenticated Subscriber+ Stored Cross-Site Scripting via REST API Parameters vulnerability discovered by Nguyen Truong Roll in WordPress Plugin Ninja Forms - Scheduled Exports versions = 3.0.3...

wp2shell-poc

wp2shell-poc Independent proof-of-concept for the unauthentic...

Improper Access Control

Spring Data REST is vulnerable to Improper Access Control. The vulnerability is due to insufficient protection of identifier @Id and version @Version properties from mutation through RFC 6902 JSON Patch requests, which allows an attacker to modify these properties and potentially alter resource...

cats cats-14.0.0

CATS documentation is available at https://endava.github.io/cats/ REST API fuzzer and negative testing tool. Run thousands of self-healing API tests within minutes with no coding effort! Comprehensive : tests are generated automatically based on a large number scenarios and cover every field and...

PT-2026-86767

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

CVE-2026-86417: Exposure of Sensitive Information to an Unauthorized Actor

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

CVE-2026-86426: Improper Authentication

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

CVE-2026-86479: Missing Authorization

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR...

PT-2026-86851

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR...

PT-2026-86792

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...