EUVD-2026-54962

A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The...

CVE-2026-19374 adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery

A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The...

CVE-2026-19374 adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery

A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The...

CVE-2026-19374 adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery

A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The...

PT-2026-69319

Name of the Vulnerable Software and Affected Versions adafap api-mcp versions up to 92b9a5d04acfec165c7d4ef852496593aa87be06 Description A server-side request forgery issue exists in the Proxy API Endpoint component within the file app/api/proxy/route.ts. The flaw occurs in the customAxios...

CVE-2026-19374: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The...

EUVD-2026-52753

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...

EUVD-2026-50359

MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...

CVE-2026-66723

MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...

CVE-2026-66723 Missing authentication requirement in Remote Instances proxy API in MWDB Core

MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...

CVE-2026-66723: Missing Authorization

MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...

Kubernetes Dashboard Detection

Detects Kubernetes Dashboard login UI and proxy API paths. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Kubernetes Dashboard UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Kubernetes Dashboard...

Kubernetes Dashboard Unauth Verification

Confirms Kubernetes Dashboard settings allowing skip-login or open proxy API. !/usr/bin/env python3 -- coding: utf-8 -- """Verify Kubernetes Dashboard skip-login and API proxy exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

CVE-2026-42208

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An...

PT-2026-38545

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/api tools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

CLI Proxy API code-related vulnerabilities

CLI Proxy API is an open-source CLI proxy server developed by Router-For.ME, which supports multi-model APIs. Version 6.9.29 of the CLI Proxy API has a code vulnerability that stems from the handling of the url parameter in the file internal/api/handlers/management/apitools.go. This vulnerability...

GO-2026-4589 Rancher cloud credentials can be used through proxy API by users without access in github.com/rancher/rancher

Rancher cloud credentials can be used through proxy API by users without access in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

Insufficient Granularity of Access Control

Overview github.com/rancher/rancher/pkg/controllers/user/rbac is an open source project that provides a container management platform built for organizations that deploy containers in production. Rancher makes it easy to run Kubernetes everywhere, meet IT requirements, and empower DevOps teams...

Rancher cloud credentials can be used through proxy API by users without access

A vulnerability was discovered in Rancher 2.2.0 through the aforementioned patched versions, where cloud credentials weren't being properly validated through the Rancher API. Specifically through a proxy designed to communicate with cloud providers. Any Rancher user that was logged-in and aware o...

Insufficient Granularity of Access Control

Overview Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the cloud providers API. An attacker can gain unauthorized access to cloud provider APIs and perform actions with attached cloud credentials by sending crafted requests through the proxy API...