CVE-2026-82909

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

LEAKEY

LEAKEY 🔑 LEAKEY es una herramienta para la validación de tokens/claves API filtrados encontrados durante pruebas de penetración y compromisos de Red Team. El script es muy útil para Bug Hunters con el fin de validar y determinar el impacto de credenciales filtradas. LEAKEY utiliza un archivo de...

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

SiYuan <= 3.6.5 - Unauthenticated Path Traversal

SiYuan = 3.6.5 contains a path traversal via double URL-encoding in the /assets/ route publish mode port 6808, allowing unauthenticated attackers to read arbitrary files inside WorkspaceDir including conf/conf.json which exposes the API token and access auth code. id: CVE-2026-54066 info: name:...

CVE-2026-81853

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashadmin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decodeprimarykey/2 decodes the composite-primary-key form Base64 plus ETF and returns the decoded map verbatim as th...

CVE-2026-82650

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function kernel/model/template.go, reachable via the POST /api/template/render endpoint kernel/api/template.go. The endpoint restricts the supplied path only to the workspace directory...

CVE-2026-82650

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the POST /api/template/render endpoint. The endpoint restricts the supplied path to the workspace directory (util.IsAbsPathInWorkspace) but, unli...

CVE-2026-82650 SiYuan before v3.8.1 Path Traversal via /api/template/render

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function kernel/model/template.go, reachable via the POST /api/template/render endpoint kernel/api/template.go. The endpoint restricts the supplied path only to the workspace directory...

CVE-2021-41805

CVE-2021-41805 Hashicorp Consul RCE tramite API HashiCorp Consul Enterprise prima della versione 1.8.17, 1.9.x prima di 1.9.11 e 1.10.x prima di 1.10.4 presenta un controllo di accesso errato. Un token ACL con i permessi predefiniti operator:write in un namespace può essere utilizzato per...

CVE-2022-24112-POC

CVE-2022-24112-POC Apache APISIX 2.12.1 Esecuzione di codice in remoto tramite bypass della restrizione IP e utilizzo del token admin AIP predefinito Guida completa https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff...

CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939

Flextype CMS through v1.0.0-dev is affected by an expression language injection in its Symfony ExpressionLanguage engine , reachable via the POST /api/v1/query endpoint. Unsanitized, user-supplied input is passed to the engine, exposing application objects such as filesystem() and serializers() w...

EUVD-2026-67793

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

PT-2026-83281

Name of the Vulnerable Software and Affected Versions Flextype CMS versions prior to 1.0.0-dev Description An expression language injection exists that allows authenticated attackers with a valid API token to read arbitrary files. This occurs when unsanitized user input is passed to the Symfony...

CVE-2026-25099

CVE-2026-25099 - Bludit CMS API Unbeschränkter Datei-Upload zu RCE Beschreibung Bludit CMS-Versionen vor 3.18.4 erlauben einem authentifizierten Angreifer mit einem gültigen API-Token, Dateien beliebigen Typs und beliebiger Erweiterung über den Endpunkt POST /api/files/ hochzuladen. Die Funktion...

CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication

CVE-2026-30824 — Flowise NVIDIA NIM Authentifizierungs-Bypass-Checker und Exploit Ein Proof-of-Concept-Checker und Exploit für CVE-2026-30824 , eine kritische Authentifizierungs-Bypass-Schwachstelle in Flowise, die NVIDIA-NIM-API-Endpunkte ohne Authentifizierung freigibt. Schwachstellenübersicht...

CVE-2026-30944-PoC

🔓 CVE-2026-30944 Escalata di Privilegi in StudioCMS tramite Generazione Non Sicura di Token API NVD • Advisory • CWE-639 Panoramica L'endpoint POST /studiocmsapi/dashboard/api-tokens in StudioCMS ≤ 0.3.0 consente a qualsiasi utente autenticato con ruolo minimo Editor di generare token API per...

CVE-2026-81027 one-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinning

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the...

CVE-2026-80201

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...