LEAKEY

LEAKEY 🔑 LEAKEY is a tool is for validation of leaked API tokens/keys found during pentesting and Red Team Enegagments. The script is really useful for Bug Hunters inorder to validate and determine the impact of leaked credentials. LEAKEY uses a json based signature file located at...

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access

argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token. id:...

SiYuan <= 3.6.5 - Unauthenticated Path Traversal

SiYuan = 3.6.5 contains a path traversal via double URL-encoding in the /assets/ route publish mode port 6808, allowing unauthenticated attackers to read arbitrary files inside WorkspaceDir including conf/conf.json which exposes the API token and access auth code. id: CVE-2026-54066 info: name:...

CVE-2022-24112-POC

CVE-2022-24112-POC Apache APISIX 2.12.1 Remote Code Execution by IP restriction bypass and using default admin AIP token Full walkthrough https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff...

CVE-2021-41805

CVE-2021-41805 Hashicorp Consul RCE via API HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token with the default operator:write permissions in one namespace can be used for unintended privilege escalation in a differe...

CVE-2023-48084

CVE-2023-48084 Fixes broken syntax in the POC, primarily incorrect import and incorrect referral to API functions. automates the APIToken retrieval, stores the token as a variable and pipes into the fixed POC. https://github.com/Hamibubu/CVE-2023-48084 If for some reason this does not work,...

CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

EUVD-2026-96992

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-108718

The Rill platform (versions 0.77.0 through 0.90.5 ) contains a missing authorization vulnerability within the admin OAuth server . The flaw allows the server to issue authorization codes to dynamically registered clients without requiring explicit user consent. An attacker can register a maliciou...

CVE-2026-108114

Strapi versions 5.47.0 through 5.57.0 are vulnerable to an improper authorization flaw (CWE-863) involving Admin API tokens. The root cause lies in the reconcileTokenPermissionsToUserCeiling function, which fails to account for token permissions containing omitted or null fields . Consequently, e...

Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

Summary API token permission checks only match the HTTP method and route path. The expand query parameter on task read endpoints embeds data from other permission groups task comments, reactions, time entry counts without checking whether the token holds those scopes. A token scoped only to tasks...

EUVD-2026-95991

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web...

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Executive Summary Vikunja accepts both regular-user JSON Web Tokens JWTs and link-share JWTs through its generic authenticated API route group. A link-share JWT resolves to a models.LinkSharing principal whose GetID method returns the numeric linkshares.id. The API-token management model then...

GHSA-VVCV-VPPH-H844 Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Executive Summary Vikunja accepts both regular-user JSON Web Tokens JWTs and link-share JWTs through its generic authenticated API route group. A link-share JWT resolves to a models.LinkSharing principal whose GetID method returns the numeric linkshares.id. The API-token management model then...

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...

CVE-2026-25099

CVE-2026-25099 - Bludit CMS API Unrestricted File Upload to RCE Description Bludit CMS versions before 3.18.4 allow an authenticated attacker with a valid API token to upload files of any type and extension via the POST /api/files/ endpoint. The uploadFile function performs no file extension or...

CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication

CVE-2026-30824 — Flowise NVIDIA NIM Authentication Bypass Checker and Exploit A proof-of-concept checker and exploit for CVE-2026-30824 , a critical authentication bypass vulnerability in Flowise that exposes NVIDIA NIM API endpoints without authentication. Vulnerability Overview CVE-2026-30824 i...

CVE-2026-30944-PoC

🔓 CVE-2026-30944 StudioCMS Privilege Escalation via Insecure API Token Generation NVD • Advisory • CWE-639 Overview The POST /studiocmsapi/dashboard/api-tokens endpoint in StudioCMS ≤ 0.3.0 allows any authenticated user at minimum Editor role to generate API tokens for any other user , including...