PT-2025-45649

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...

CVE-2025-59363: Incorrect Resource Transfer Between Spheres

In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 even though this secret should only be returned when an App is first created,...

CVE-2025-54376

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time applicatio...

CVE-2025-54123

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at "/api/v2/hoverfly/middleware" endpoint due to insufficient validation and sanitization in user input. The vulnerability exists...

CVE-2025-56413

OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the /api/v2/hosts/ssh/operate endpoint...

CVE-2025-10229: URL Redirection to Untrusted Site

A vulnerability has been found in Freshwork up to 1.2.3. This impacts an unknown function of the file /api/v2/logout. Such manipulation of the argument postlogoutredirecturi leads to open redirect. The attack can be executed remotely. The exploit has been disclosed to the public and may be used...

MAL-2025-33394 Malicious code in skynet-api-v2 (npm)

The package skynet-api-v2 was found to contain malicious code...

CVE-2025-53018

Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery SSRF vulnerability exists in the "/api/v2/Photo::fromUrl" endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose...

CVE-2025-53018: Server-Side Request Forgery (SSRF)

Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery SSRF vulnerability exists in the /api/v2/Photo::fromUrl endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose...

CVE-2025-32896 Apache SeaTunnel: Unauthenticated insecure access

Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. Details Unauthorized users can access /hazelcast/rest/maps/submit-job to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and...

CVE-2024-10965

A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2/schema of the component JSON File Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The pat...

CVE-2025-48695: Incorrect Privilege Assignment

An issue was discovered in CyberDAVA before 1.1.20. A privilege escalation vulnerability allows a low-privileged user to escalate their privilege by abusing the following API due to the lack of access control: /api/v2/users/user/ /role/ROLE/ admin access can be achieved...

errbot-hl (>=8.0.0, <=8.0.2), pantos-client-library (>=3.1.0, <=3.1.3) +2 more potentially affected by CVE-2025-47273 via setuptools (75.7.0)

setuptools PYPI version 75.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - errbot-hl =8.0.0, =3.1.0, =4.1.0, =0.5.13, =0.5.14 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

errbot-hl (>=8.0.0, <=8.0.2), pantos-client-library (>=3.1.0, <=3.1.3) +2 more potentially affected by CVE-2025-47273 via setuptools (75.7.0)

setuptools PYPI version 75.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - errbot-hl =8.0.0, =3.1.0, =4.1.0, =0.5.13, =0.5.14 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...

MAL-2025-2826 Malicious code in @uniqa/self-service-ms-api-v2 (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-12029

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

CVE-2024-12029: Deserialization of Untrusted Data

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

PT-2025-3901

Name of the Vulnerable Software and Affected Versions AquilaCMS version 1.412.13 Description A critical issue affects some unknown functionality of the file /api/v2/categories. The manipulation of the PostBody.populate argument leads to deserialization. This issue can be exploited remotely. The...

CVE-2025-0465: Deserialization of Untrusted Data

A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v2/categories. The manipulation of the argument PostBody.populate leads to deserialization. The attack may be launched remotely. The exploit has be...

CVE-2024-10965

A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2/schema of the component JSON File Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The pat...