EUVD-2026-92476

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-104893 Plane: Improper validation allows arbitrary modification of API token rate limits

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-104893

The project management tool Plane is vulnerable to improper validation in its API. Prior to version 1.4.0 , an authenticated user can use the PATCH /api/users/api-tokens/{token_id}/ endpoint to modify the allowed_rate_limit field without server-side validation or a maximum limit. This allows an a...

CVE-2026-104893

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

SUSE CVE-2026-71886

In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify...

SUSE CVE-2026-71887

In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...

CVE-2026-104892 Plane: Plaintext logging of API token

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0...

CVE-2026-88394

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...

USN-8870-1 aodh, watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

USN-8870-1: OpenStack Aodh and Watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

Flowise NVIDIA NIM Auth Bypass (CVE-2026-30824)

Exploits CVE-2026-30824 in Flowise 3.0.13: /api/v1/nvidia-nim/ routes are whitelisted in auth middleware, allowing unauthenticated token generation and container management API access. !/usr/bin/env python3 -- coding: utf-8 -- """Flowise NVIDIA NIM auth bypass token leak CVE-2026-30824.""" import...

mcp-server-kubernetes RCE (CVE-2026-61459)

Full-chain CVE-2026-61459: inject --server into kubectl MCP tools to exfiltrate the cluster bearer token, then create a privileged pod running the configured reverse CMD payload via the Kubernetes API. !/usr/bin/env python3 -- coding: utf-8 -- """mcp-server-kubernetes argument injection to pod RC...

Node-RED Unauthenticated Flow RCE

Deploys a malicious Node-RED flow via the admin API when authentication is disabled or credentials are known. Uses an inject + exec node chain to run the configured reverse CMD payload. Complements CVE-2026-71269 detection. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED unauthenticated flo...

Ivanti Endpoint Manager Auth Bypass (CVE-2026-1603)

Exploits CVE-2026-1603 in Ivanti Endpoint Manager 2024 SU5: unauthenticated POST to /RemoteControlAuth/api/Auth with logintype 64 leaks session identifiers and stored credential metadata. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Endpoint Manager auth bypass CVE-2026-1603.""" import jso...

GL.iNET Wi-Fi Key Disclosure (CVE-2023-31478)

Exploits CVE-2023-31478 in GL.iNet routers 3.216: unauthenticated POST to /api/router/mesh/status leaks SSID and Wi-Fi encryption key. !/usr/bin/env python3 -- coding: utf-8 -- """GL.iNET mesh status Wi-Fi key disclosure CVE-2023-31478.""" from kittysploit import from lib.protocols.http.httpclien...

Kemp LoadMaster Command Injection (CVE-2024-1212)

Exploits CVE-2024-1212 in Progress Kemp LoadMaster: unauthenticated command injection via /access/set?param=enableapi&value=... management API. !/usr/bin/env python3 -- coding: utf-8 -- """Progress Kemp LoadMaster unauth command injection CVE-2024-1212.""" import re import urllib.parse from...

Fortinet FortiWeb Fabric Connector SQLi (CVE-2025-25257)

Exploits CVE-2025-25257 pre-auth SQL injection in FortiWeb Fabric Connector /api/fabric/device/status via a crafted Authorization Bearer token, then attempts OS command execution through stacked SQL payloads WatchTowr chain. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiWeb Fabric...

Ivanti Connect Secure Command Injection (CVE-2024-21887)

Chains CVE-2023-46805 path traversal auth bypass with CVE-2024-21887 command injection via /api/v1/totp/user-backup-code/../../admin/config/set on Ivanti Connect Secure / Policy Secure gateways. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Connect Secure auth bypass + command injection...

Ivanti EPMM Authentication Bypass (CVE-2023-35082)

Exploits CVE-2023-35082 in Ivanti EPMM MobileIron Core 11.2 and older: unauthenticated access to /mifs/asfV3/api/v2/admins/users allows admin enumeration and account creation. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPMM/MobileIron unauthenticated API access CVE-2023-35082.""" import...

Langflow Broken Access Control (CVE-2026-21445)

Exploits CVE-2026-21445 in Langflow 1.7.0.dev45: unauthenticated access to /api/v1/monitor/messages and related monitor endpoints exposes user conversation data and allows destructive operations without authorization. !/usr/bin/env python3 -- coding: utf-8 -- """Langflow broken access control on...