CVE-2026-108905

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...

CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...

PT-2026-110215

Name of the Vulnerable Software and Affected Versions pH7Builder versions prior to 18.6.0 Description An issue exists in Tool.class.php where a hard-coded API key allows unauthenticated attackers to bypass API access checks. By spoofing the Host header to localhost and using the private api key...

CVE-2026-40196

HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the...

EUVD-2026-23539

HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the...

EUVD-2018-10957

Malware in sbrugna...

CVE-2020-15087

In Presto before version 337, authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations with secure internal communication configured. This does not affect installations that have not configured secure internal communication,...

CVE-2021-42557

In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials...

PT-2021-23628

Name of the Vulnerable Software and Affected Versions Jeedom versions 4.1.19 and earlier Description A bug in the software allows a remote attacker to bypass API access and retrieve user credentials. Recommendations For Jeedom versions 4.1.19 and earlier, update to a version later than 4.1.19 to...

CVE-2021-42557: Undefined Security Weakness

In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials...

Adobe Reader DC Bypass

The vulnerability of the Adobe Reader DC PDF viewer program is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass restrictions on access to the JavaScript API...