CVE-2024-11037 Path Traversal in binary-husky/gpt_academic

A path traversal vulnerability exists in binary-husky/gptacademic at commit 679352d, which allows an attacker to bypass the blockedpaths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating syste...

PT-2025-12251

Name of the Vulnerable Software and Affected Versions composiohq/composio version 0.5.10 Description The issue arises from the API's failure to validate the x-api-key header's value during authentication. This allows an attacker to bypass authentication by providing any random value in the...

PT-2025-12025

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm versions prior to the commit that fixes the issue affected versions not specified Description A vulnerability allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access...

PT-2025-12091

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic at commit 679352d Description A path traversal issue exists, allowing an attacker to bypass the blocked paths protection and read sensitive information, such as the OpenAI API key, from the config.py file. This issue...

CVE-2024-6842: Missing Authentication for Critical Function

In version 1.5.5 of mintplex-labs/anything-llm, the /setup-complete API endpoint allows unauthorized users to access sensitive system settings. The data returned by the currentSettings function includes sensitive information such as API keys for search engines, which can be exploited by attackers...

CVE-2024-9606: Improper Output Neutralization for Logs

In berriai/litellm before version 1.44.12, the litellm/litellmcoreutils/litellmlogging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount ...

CVE-2024-8954: Missing Critical Step in Authentication

In composiohq/composio version 0.5.10, the API does not validate the x-api-key header's value during the authentication step. This vulnerability allows an attacker to bypass authentication by providing any random value in the x-api-key header, thereby gaining unauthorized access to the server...

CVE-2024-11037: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in binary-husky/gptacademic at commit 679352d, which allows an attacker to bypass the blockedpaths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating syste...

CVE-2024-10109: Incorrect Authorization

A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of...

Jenkins Zoho QEngine Plugin Displays Unmasked API Keys

Jenkins Zoho QEngine Plugin 1.0.29.vfacc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it...

CVE-2025-30197

Jenkins Zoho QEngine Plugin 1.0.29.vfacc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it...

CVE-2025-30197

Jenkins Zoho QEngine Plugin 1.0.29.vfacc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it...

CVE-2025-30197

Jenkins Zoho QEngine Plugin 1.0.29.vfacc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it...

CVE-2025-30197

Jenkins Zoho QEngine Plugin 1.0.29.vfacc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it...

CVE-2025-30197

The Jenkins Zoho QEngine Plugin versions 1.0.29.vfa_cc23396502 and earlier are vulnerable because the QEngine API Key form field is not masked. This lack of masking increases the risk that an attacker could observe and capture the API key. At this time, no specific version containing a fix is ide...

PT-2025-11702

Name of the Vulnerable Software and Affected Versions Jenkins Zoho QEngine Plugin versions 1.0.29.vfa cc23396502 and earlier Description The issue concerns the Jenkins Zoho QEngine Plugin, where the QEngine API Key form field is not masked, potentially allowing attackers to observe and capture it...

Jenkins Zoho QEngine Plugin 安全漏洞

Jenkins Zoho QEngine Plugin is a Jenkins plugin for Jenkins open source. A security vulnerability exists in Jenkins Zoho QEngine Plugin 1.0.29.vfacc23396502 and prior versions, which stems from an unmasked QEngine API Key form field...

CVE-2025-30197: Missing Password Field Masking

Jenkins Zoho QEngine Plugin 1.0.29.vfacc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it...

CVE-2025-1285

The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the deleteapikey and saveapikey AJAX actions in all versions up to, and including, 3.6. This makes it possible for unauthenticated attackers to issue requests to...

CVE-2025-1285

CVE-2025-1285 affects the Resido – Real Estate WordPress Theme. The vulnerability arises from a missing capability check on the delete_api_key and save_api_key AJAX actions in all versions up to and including 3.6, enabling unauthenticated attackers to issue requests to internal services and updat...