CVE-2026-112340

Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace...

EUVD-2026-118283

Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace...

CVE-2026-112340

Wazuh dashboard plugins versions 4.9.0 before 4.14.9 are affected by an authorization bypass vulnerability. The flaw exists in the /api/request proxy endpoint, where authenticated dashboard users can override the Manager API Authorization header. By supplying nested body.headers.Authorization val...

CVE-2026-112340: wazuh wazuh-dashboard-plugins: Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows…

Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace...

westone-CVE-2021-45232-scanner

westone-CVE-2021-45232-scanner Apache APISIX Dashboard earlier versions 2.10.1 has security vulnerability on unauthorized access. the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on...

CVE-2021-21983

CVE-2021-21975 VMware vRealize Operations vROps Manager API Arbitrary File Write Leads to Remote Code Execution RCE vRealize Operations vROps is a tool that self-driving IT operations management powered by AI from apps to infrastructure to optimize, plan and scale VMware Cloud and HCI deployments...

CVE-2024-26026

CVE-2024-26026 BIG-IP Next Central Manager API UNAUTHENTICATED SQL INJECTION link: https://eclypsium.com/blog/big-vulnerabilities-in-next-gen-big-ip/...

warsend

WARSend Apache Tomcat Manager API WAR Shell Upload Prerequisites Credentials Text API Access to Tomcat Manager $ ./warsend.sh 10.10.14.232 8090 10.10.10.184 8080 tomcat $3cureP4s5w0rd! revshell | | / / | / / / / / | | /| / / /| | / // /\ / / / / | |/ |/ / |/ , // / / / / / // / |/|// |//...

Big-IP-Next-CVE-2024-26026

CVE-2024-26026 BIG-IP Next Central Manager API UNAUTHENTICATED SQL INJECTION link: https://eclypsium.com/blog/big-vulnerabilities-in-next-gen-big-ip/...

CVE-2026-116017

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request...

CVE-2026-116017 Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request...

EUVD-2026-109275

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request...

CVE-2026-116017 Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request...

CVE-2026-116017

The Xiaozhi-esp32-server software (versions before 0.9.8 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the manager-api DeviceController.getAddressBook handler. This vulnerability allows authenticated users, including those with normal or self-registered accounts, to access...

PT-2026-122598

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request...

Xinan Technology Xiaozhi-ESP32 Server Authorization Issue Vulnerability

Versions prior to 0.9.8 of Xinan Technology’s xiaozhi-esp32-server contain an authorization issue vulnerability. This vulnerability stems from an unsafe direct object reference in the DeviceController.getAddressBook handler within manager-api. Attackers can use either a regular account or a...

CentOS Linux 7 [TuxCare] Security Update: squid / squid-migration-script / squid-sysvinit Multiple Vulnerabilities (CENTOS7:CLSA-2026:1790851347)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1790851347 advisory. - An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service...

CLSA-2026-1792455642 TuxCare security update for @storybook/manager-api (1 CVE)

TuxCare rebuilt @storybook/manager-api to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

PT-2026-133221

TuxCare rebuilt @storybook/manager-api to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

Piranha CMS authorization issue vulnerability

Piranha CMS 12.2 and earlier versions have an authorization issue. This vulnerability stems from a lack of authorization in Piranha.Manager LanguageApiController. Any authenticated administrator user can list, create, edit, or delete site languages without having the necessary permissions for...