CVE-2013-10077

A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been mad...

CVE-2026-93846

Mattermost versions 11.7.x = 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the update-team-member-roles REST API.. Mattermost...

CVE-2026-93846

Mattermost versions 11.7.x = 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the update-team-member-roles REST API.. Mattermost...

CVE-2026-93846 Team admin can escalate a team member's permissions via the team member roles endpoint

Mattermost versions 11.7.x = 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the update-team-member-roles REST API.. Mattermost...

CVE-2026-77058

boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...

CVE-2026-77053

boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuratio...

CVE-2026-77054

boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form...

CVE-2026-116339

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/execddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been...

EUVD-2026-109956

boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and...

EUVD-2026-109953

boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...

CVE-2026-77058

boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints. The root cause is the absence of CSRF tokens and a failure to validate Origin or Referer headers. A remote attacker can lure a user on the internal network to a malicious webpage that sends cross-...

CVE-2026-77054 Cleartext Storage of Sensitive Information in boneIO

boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form...

EUVD-2026-109949

boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form...

CVE-2026-77054

The boneIO Black software is vulnerable to cleartext storage of sensitive information, specifically MQTT broker and web panel passwords. The GET /api/config endpoint exposes these passwords in cleartext to any authenticated user. Furthermore, because authentication is disabled by default (CVE-202...

EUVD-2026-109948

boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuratio...

CVE-2026-77053

The boneIO Black firmware is vulnerable to missing authentication, where the management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, leading to denial of service , configuration ...

EUVD-2026-109947

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

EUVD-2026-109940

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/execddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been...

CVE-2026-115195

A broken access control vulnerability exists in the Mautic Stats API /api/stats/table. The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As...

CVE-2026-115188

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user...