EUVD-2026-91750

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network...

CVE-2026-101104

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate configurations of devices they do not own. By exploiting this flaw, an attacker can alter device settings, trigger unintended behaviors, or access sensitive informatio...

EUVD-2026-91746

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...

CVE-2026-101104 Missing Authorization in Meari IoT Cloud Platform OpenAPI Service

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...

CVE-2026-22785

CVE-2026-22785 재현 튜토리얼 취약점 개요 CVE : CVE-2026-22785 영향 : orval = 7.18.0 CVSS : 9.3 CRITICAL 유형 : 코드 주입 취약점 원리 orval 예시 python cvetool.py shell whoami python cvetool.py shell "node --version" python cvetool.py shell dir 파일 스캔 python cvetool.py scan 3. 출력 설명 + CVE-2026-22785: Payload 주입 성공 + 주입 위치:...

CVE-2026-23947-PoC

Walkthrough: CVE-2026-23947 - Orval 임의 코드 실행 이 워크스루는 신뢰할 수 없는 OpenAPI 스펙이 x-enumDescriptions 및 x-enumNames 필드를 통해 Orval을 악용하여 생성된 클라이언트에 임의 코드를 주입할 수 있는 방법을 보여줍니다. 사전 요구 사항 Node.js v20 또는 v22 npm 설정 1. 프로젝트를 생성하고 취약한 버전의 orval예: 7.10.0을 설치합니다: mkdir orval-poc cd orval-poc npm init -y npm install...

CVE-2026-33331

CVE-2026-33331 — oRPC OpenAPI 참조 플러그인의 저장형 XSS orpc의 OpenAPI 문서 생성에서 발생하는 저장형 XSS에 대한 개념 증명 실습 환경 목적 oRPC는 OpenAPI 스펙을 기반으로 API 문서 페이지를 생성합니다. v1.13.9 이전 버전에서는 HTML 인코딩 없이 JSON.stringify를 사용하여 스펙을 태그에 직접 넣었습니다. 공격자가 제어할 수 있는 info.description과 같은 필드는 해당 태그를 조기에 닫고 스크립트를 실행할 수 있었습니다. 이 저장소는 버그를 재현할...

BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader

A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function loadopenapispecasync of the file litellm/proxy/experimental/mcpserver/openapitomcpgenerator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument specpath causes...

reburp

reburp Burp의 API/MCP는 제한적입니다 - reburp는 전체 Montoya API를 로컬에서 제공되는 openapi REST API로 노출하는 Burp Suite 확장으로, AI 에이전트에 최적화되어 있습니다. Issues | Discussions reburp란 무엇인가 reburp는 Burp Suite를 스크립트로 제어할 수 있게 만들어 줍니다. Java 확장으로 로드되어 Montoya API를 http://127.0.0.1:9090에서 HTTP REST API로 제공하며, OpenAPI 스펙과 Swagger...

Meari IoT Cloud Platform OpenAPI Service

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization. 2. RECOMMENDED...

PT-2026-104070

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network...

PT-2026-104068

Name of the Vulnerable Software and Affected Versions Meari IoT Cloud Platform OpenAPI Service affected versions not specified Description An authorization flaw exists in the OpenAPI Service that allows authenticated users to manipulate configurations of devices they do not own. This issue enable...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module tar (CVE-2026-59871, CVE-2026-59873, CVE-2026-59874 and CVE-2026-59875)

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to Node.js module tar. Vulnerability Details CVEID:CVE-2026-59871 DESCRIPTION: node-tar ...

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io: /api/v1/full-spec의 인증 누락으로 전체 OpenAPI 스키마 노출 제품: dgtlmoon/changedetection.io — v0.55.7 파일: changedetectionio/api/Spec.py CWE: CWE-306 — 중요 기능에 대한 인증 누락 CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — 5.3 중간 CNA: Turan Security · CVE 레코드 설명 changedetection.io의...

CVE-2026-101059

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...

CVE-2026-101059 utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...

EUVD-2026-87984

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...

CVE-2026-101059 utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...

CVE-2026-101059

The utcp-http library, in versions before 1.1.4 , is vulnerable to a Trust Boundary Bypass involving the OAuth2 tokenUrl field. The library fails to validate this field when it is sourced from remote OpenAPI specifications . An attacker can exploit this by providing a malicious OpenAPI specificat...

CVE-2026-101059: Server-Side Request Forgery (SSRF)

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...