3289 matches found
CVE-2026-108905
Versions of pH7Builder (pH7 Social Dating CMS) prior to 18.6.0 are vulnerable to a hard-coded API key flaw in Tool.class.php . Unauthenticated attackers can bypass API access checks by spoofing the Host header (e.g., Host: localhost) while providing the hard-coded key private_api_key=dev772277. T...
CVE-2026-108904 pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController
pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...
CVE-2026-108719
LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callbackurl extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the...
CVE-2026-108719
LLMGateway through 1.20.0 is vulnerable to a blind server-side request forgery (SSRF) vulnerability in its video-generation callback_url extension. API key holders can exploit this by supplying loopback, private, or cloud-metadata URLs. The vulnerability exists because the application fails to pe...
CVE-2026-108719 LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url
LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callbackurl extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the...
EUVD-2026-96993
LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callbackurl extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the...
CVE-2026-108719 LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url
LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callbackurl extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the...
CVE-2026-108719: Server-Side Request Forgery (SSRF)
LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callbackurl extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the...
PT-2026-110142
Name of the Vulnerable Software and Affected Versions OpenAgents Workspace backend versions prior to 1.0.18 Description An information disclosure issue exists that allows unauthenticated attackers to list all workspaces. By accessing the 'GET /v1/workspaces' endpoint, attackers can retrieve...
CVE-2026-107761: Insertion of Sensitive Information Into Sent Data
Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platfor...
PT-2026-110114
Name of the Vulnerable Software and Affected Versions Plastic Labs Honcho versions prior to 3.3.1 Description An incorrect authorization issue exists where holders of peer- or session-scoped API keys can access workspace data. This occurs because the get or create workspace function only verifies...
EUVD-2026-95937
pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether t...
CVE-2026-107841 pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents
pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether t...
GHSA-R44W-V6GF-X3P6 pyLoad has an authentication bypass in API key validation (check_apikey cache)
Summary The API-key cache in checkapikey allows an attacker to authenticate with a forged API key as long as the legitimate key for the same keyid has been used recently. On a cache hit, the API key secret is never verified, resulting in a complete authentication bypass during the cache lifetime...
BIT-GHOST-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API
Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...
CVE-2026-101998
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refres...
EUVD-2026-95157
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refres...
CVE-2026-101998
Docker Sandboxes are vulnerable to a fail-open response masking issue where certain handlers may forward unmasked bytes when a response-body read returns data alongside an error. This vulnerability allows code running inside an authorized sandbox to potentially recover sensitive host-managed OAut...
CVE-2026-101998 Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refres...