EUVD-2022-5215

Malicious code in bioql PyPI...

EUVD-2022-25997

Malicious code in bioql PyPI...

EUVD-2022-41840

Malicious code in bioql PyPI...

CVE-2025-55797

An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/schemaId endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed...

Access Control Bypass

Overview FormCMS is a FormCMS is an open-source Content Management System designed to simplify and accelerate web development workflows for CMS projects and general web applications. It streamlines data modeling, backend development, and frontend design, making them as intuitive as filling out a...

GHSA-6CWX-42HW-W69C FormCMS has an improper access control vulnerability in the /api/schemas/history/[schemaId] endpoint

An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/schemaId endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed...

FormCMS has an improper access control vulnerability in the /api/schemas/history/[schemaId] endpoint

An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/schemaId endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed...

CVE-2025-55797

An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/schemaId endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed...

FormCMS 安全漏洞

FormCMS is a page designer for formcms individual developers. A security vulnerability exists in FormCms version 0.5.4, which stems from improper access control of the /api/schemas/history/schemaId endpoint, which could lead to unauthenticated attackers accessing historical schema data...

CVE-2025-55797

An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/schemaId endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed...

CVE-2025-55797

An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/schemaId endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed...

CVE-2025-55797

An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/schemaId endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed...

PT-2025-40005

Name of the Vulnerable Software and Affected Versions FormCms version 0.5.4 Description An access control issue exists in FormCms version 0.5.4. An unauthenticated attacker can access historical schema data via the /api/schemas/history/schemaId API endpoint if a valid schemaId is known or guessed...

CVE-2025-59956 AgentAPI exposed user chat history via a DNS rebinding attack

AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain access to the /messages endpoint served by the Agent API. This allows for th...

CVE-2025-59956 AgentAPI exposed user chat history via a DNS rebinding attack

AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain access to the /messages endpoint served by the Agent API. This allows for th...

CVE-2025-59956 AgentAPI exposed user chat history via a DNS rebinding attack

AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain access to the /messages endpoint served by the Agent API. This allows for th...

CVE-2025-59956

The CVE-2025-59956 entry concerns AgentAPI (GitHub project for Claude Code, Goose, Aider, Gemini, Amp, Codex). Affected: 0.3.3 and earlier, when served over plain HTTP on localhost, enabling a client-side DNS rebinding attack that can access the /messages endpoint and exfiltrate local data (messa...

CVE-2025-59948 FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication setting needs to ...

GHSA-W64R-2G3W-W8W4 Coder AgentAPI exposed user chat history via a DNS rebinding attack

Summary AgentAPI prior to version 0.4.0 was susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. Impact An attacker could have gained access to the /messages endpoint served by the Agent API. This allowed for the unauthorized exfiltration of sensitive user...

Coder AgentAPI exposed user chat history via a DNS rebinding attack

Summary AgentAPI prior to version 0.4.0 was susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. Impact An attacker could have gained access to the /messages endpoint served by the Agent API. This allowed for the unauthorized exfiltration of sensitive user...