EUVD-2026-96992

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-108718

The Rill platform (versions 0.77.0 through 0.90.5 ) contains a missing authorization vulnerability within the admin OAuth server . The flaw allows the server to issue authorization codes to dynamically registered clients without requiring explicit user consent. An attacker can register a maliciou...

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access

argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token. id:...

SiYuan <= 3.6.5 - Unauthenticated Path Traversal

SiYuan = 3.6.5 contains a path traversal via double URL-encoding in the /assets/ route publish mode port 6808, allowing unauthenticated attackers to read arbitrary files inside WorkspaceDir including conf/conf.json which exposes the API token and access auth code. id: CVE-2026-54066 info: name:...

CVE-2026-108114

Strapi versions 5.47.0 through 5.57.0 are vulnerable to an improper authorization flaw (CWE-863) involving Admin API tokens. The root cause lies in the reconcileTokenPermissionsToUserCeiling function, which fails to account for token permissions containing omitted or null fields . Consequently, e...

LEAKEY

LEAKEY 🔑 LEAKEY एक उपकरण है जो पेंटेस्टिंग और रेड टीम अभियानों के दौरान मिले लीक हुए API टोकन/कीज़ के सत्यापन के लिए है। यह स्क्रिप्ट बग हंटर्स के लिए लीक हुई क्रेडेंशियल्स के प्रभाव को सत्यापित और निर्धारित करने में वास्तव में उपयोगी है। LEAKEY एक json-आधारित हस्ताक्षर फ़ाइल का उपयोग करता है जो...

CVE-2022-24112-POC

CVE-2022-24112-POC Apache APISIX 2.12.1 में IP प्रतिबंध बायपास और डिफ़ॉल्ट एडमिन AIP टोकन का उपयोग करके रिमोट कोड निष्पादन RCE पूर्ण वॉकथ्रू https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff...

CVE-2021-41805

CVE-2021-41805 Hashicorp Consul RCE via l'API HashiCorp Consul Enterprise avant 1.8.17, 1.9.x avant 1.9.11, et 1.10.x avant 1.10.4 présente un contrôle d'accès incorrect. Un jeton ACL avec les permissions par défaut operator:write dans un espace de noms peut être utilisé pour une escalade de...

Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

Summary API token permission checks only match the HTTP method and route path. The expand query parameter on task read endpoints embeds data from other permission groups task comments, reactions, time entry counts without checking whether the token holds those scopes. A token scoped only to tasks...

EUVD-2026-95991

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web...

GHSA-VVCV-VPPH-H844 Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Executive Summary Vikunja accepts both regular-user JSON Web Tokens JWTs and link-share JWTs through its generic authenticated API route group. A link-share JWT resolves to a models.LinkSharing principal whose GetID method returns the numeric linkshares.id. The API-token management model then...

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Executive Summary Vikunja accepts both regular-user JSON Web Tokens JWTs and link-share JWTs through its generic authenticated API route group. A link-share JWT resolves to a models.LinkSharing principal whose GetID method returns the numeric linkshares.id. The API-token management model then...

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...

CVE-2026-25099

CVE-2026-25099 - Bludit CMS API Téléversement de fichier sans restriction vers RCE Description Les versions de Bludit CMS antérieures à 3.18.4 permettent à un attaquant authentifié disposant d'un jeton API valide de téléverser des fichiers de tout type et extension via le point de terminaison POS...

CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication

CVE-2026-30824 — أداة فحص واستغلال تجاوز المصادقة في Flowise NVIDIA NIM أداة إثبات مفهوم للفحص والاستغلال لثغرة CVE-2026-30824 ، وهي ثغرة حرجة في تجاوز المصادقة في Flowise تكشف نقاط نهاية NVIDIA NIM API دون مصادقة. نظرة عامة على الثغرة CVE-2026-30824 هي ثغرة حرجة في تجاوز المصادقة في Flowise 3.0....

CVE-2026-30944-PoC

🔓 CVE-2026-30944 تصعيد الصلاحيات في StudioCMS عبر توليد رموز API غير آمنة NVD • Advisory • CWE-639 نظرة عامة يسمح نقطة النهاية POST /studiocmsapi/dashboard/api-tokens في StudioCMS ≤ 0.3.0 لأي مستخدم مُصادق بحد أدنى دور Editor بتوليد رموز API لأي مستخدم آخر ، بما في ذلك حسابات owner و admin. تقبل...

CVE-2026-76274 Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...

EUVD-2026-94626

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...