CVE-2026-113668 ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this...

PT-2026-120309

Summary The REST route GET /api/v1//: id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document id and learn whether the document exists and which...

PT-2022-26166 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.6RC1 XWiki Platform versions prior to 13.10.8 XWiki Platform versions prior to 14.4.3 Description: The issue allows users without the right to view documents to deduce their existence by repeated Livetable...

Elasticsearch Information Disclosure Vulnerability (CNVD-2020-60336)

Elasticsearch is the Netherlands Elasticsearch company's set of open source distributed RESTful search engine built on Lucene . The product is mainly used in cloud computing , and supports data indexing via HTTP using JSON. security is one of the data protection components. An information...