CVE-2025-58121 Insufficient permission validation on multiple REST API endpoints

Insufficient permission validation on multiple REST API endpoints in Checkmk 2.2.0, 2.3.0, and 2.4.0 before version 2.4.0p16 allows low-privileged users to perform unauthorized actions or obtain sensitive information...

CVE-2025-63667

Incorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10-20240725 allows attackers to access sensitive API endpoints without authentication...

CVE-2025-63667: Improper Access Control

Incorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10-20240725 allows attackers to access sensitive API endpoints without authentication...

CVE-2025-63667

Multiple Vatilon IP camera brands, specifically SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, and ASECAM v1.14.10-20240725, are vulnerable to an incorrect access control flaw. The devices fail to properly validate credentials before issuing Session-Id tokens, particularly at the /cgi-bin/w...

EUVD-2025-60977

The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to modify several of the plugin's settings li...

PT-2025-46265

Name of the Vulnerable Software and Affected Versions Shelf Planner plugin for WordPress versions prior to 2.7.1 Description The Shelf Planner plugin for WordPress is susceptible to unauthorized data modification. This is due to a lack of proper capability checks on several REST API endpoints. An...

CVE-2025-20377

A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to certain API endpoints. An attacker could exploit this...

CVE-2025-61113: Improper Access Control

TalkTalk 3.3.6 Android App contains improper access control vulnerabilities in multiple API endpoints. By modifying request parameters, attackers may obtain sensitive user information such as device identifiers and birthdays and access private group information, including join credentials...

MOLE TalkTalk Android App security vulnerabilities

MOLE TalkTalk Android App is a chat application from China-based MOLE. A security vulnerability exists in MOLE TalkTalk Android App version 3.3.6. The vulnerability stems from improper access control of multiple API endpoints, and an attacker may be able to obtain sensitive user information and...

CVE-2023-7322: Incorrect Authorization

Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check coul...

CVE-2023-7320 WooCommerce <= 7.8.2 - Sensitive Information Exposure

The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on the Store API's REST endpoints allowing direct external access from any origin. This can allow unauthenticated attackers to extract...

CVE-2023-7320

The CVE affects the WordPress WooCommerce plugin; versions up to 7.8.2 expose store API REST endpoints due to improper CORS handling, enabling unauthenticated access to sensitive user data (PII) from any origin. This vulnerability is caused by misconfigured Cross-Origin Resource Sharing on the St...

Siemens Industrial Edge Devices Weak Authentication (CVE-2024-54092)

Affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federati...

PT-2025-45620

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints...

CVE-2025-62516

CVE-2025-62516 entry rejected; not an active vulnerability.

EUVD-2025-35952

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints...

CVE-2025-11974 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints...

CVE-2025-11974

GitLab CVE-2025-11974 affects GitLab CE/EE versions 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1. The issue allows an unauthenticated attacker to cause a denial-of-service by uploading large files to specific API endpoints. Affected releases have been remediated via patches: Git...

CVE-2025-11974 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints...

CVE-2025-11974

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints...