8570 matches found
tv-exploit
TV Exploitation Framework Tudo começou com uma TV nov...
CVE-2026-56352: Improper Limitation of a Pathname to a Restricted Directory
n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node's localFile source option, which reads workflow files from disk without the file-access checks enforced by other file-reading nodes. Although hidden from the UI since v1.2, it remains reachable via the RE...
PT-2026-64788
Summary The Local REST API's /vault/path endpoints GET/PUT/PATCH/POST/DELETE percent-decode the request path inside the handler — after Express has already routed and normalized it, then hand it to the Obsidian vault adapter with no confinement check. A literal ../ is resolved/rejected at the...
GHSA-X9VC-9FFQ-P3GJ NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode Summary When netlicensing-mcp is run in HTTP transport mode, the ApiKeyMiddleware fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler server.py:1427. The...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the filter parameter of the REST API, specifically when the input contains both and characters, which bypasses identifier escaping in the sqlColumn function. An attacker can access sensitive data, suc...
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
Summary Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A scoped ApiKey with fullaccess=0 and an ApiAccess row granting allowget=1 on the clientes resource only no other rights, no UI session, no admin issued one GET /api/3/clientes?filter0UNION%20SELECT%20.....
GHSA-V8HX-4VX8-WC96 Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP
Summary Two-factor authentication TOTP can be fully bypassed for the REST API. The KIMAISESSION cookie returned in the response to the login request; issued after only the password is verified, before the TOTP step; is already accepted as authenticated by every /api/ endpoint. So after submitting...
CVE-2026-9561: Use of Less Trusted Source
Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 Web Console and org.eclipse.kura.rest.provider REST API components use this header as the primary IP sour...
PT-2026-60094
Summary Two-factor authentication TOTP can be fully bypassed for the REST API. The KIMAI SESSION cookie returned in the response to the login request; issued after only the password is verified, before the TOTP step; is already accepted as authenticated by every /api/ endpoint. So after submittin...
PT-2026-58994
Summary Two-factor authentication TOTP can be fully bypassed for the REST API. The KIMAI SESSION cookie returned in the response to the login request; issued after only the password is verified, before the TOTP step; is already accepted as authenticated by every /api/ endpoint. So after submittin...
MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks
In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...
PYSEC-2026-2660 MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks
In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...
PYSEC-2026-2682 Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
Impact A stored Cross-Site Scripting XSS vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with elements that the attacker can make look indistinguishable from legitimate controls single click interaction. T...
beetcamp (>=0.18.0, <=0.19.3), beets-extended-metadata (0.1.9) +4 more potentially affected by CVE-2026-42052 via beets (1.6.0)
beets PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on beets and may be impacted: - beetcamp =0.18.0, =0.3.1, =0.2.0, =0.3.24, =0.4.0 Source cves: CVE-2026-42052 Source advisory: OSV:PYSEC-2026-2397...
CVE-2026-9597
Mattermost advisory MMSA-2026-00681 documents a vulnerability in Mattermost where versions 11.7.x <= 11.7.2 and 11.6.x
PT-2026-59309
In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...
PT-2026-59330
Impact A stored Cross-Site Scripting XSS vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with elements that the attacker can make look indistinguishable from legitimate controls single click interaction. T...
CVE-2026-12126
CVE-2026-12126 affects the WCFM Marketplace plugin for WordPress (versions
CVE-2026-12426 Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel
The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the membersfilterprotectedpostsforrest. This makes it possible for unauthenticated attackers to extract determine the existence...
CVE-2026-13756 WP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter
The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the update handler for the /wp-json/wpgb/v2/metadata REST endpoint. This makes it possible for authenticated...