CVE-2026-10580

The CVE-2026-10580 entry describes an Authentication Bypass vulnerability in the Hippoo Mobile App for WooCommerce WordPress plugin (versions up to 1.9.4). A logic conflation in HippooPermissions::get_user_permissions() makes administrators and unauthenticated visitors share a null sentinel, whic...

klever-go: REST API slow-header connection exhaustion via Gin Engine.Run

Summary The Klever seednode REST API starts a Gin engine with Engine.RunrestAPIInterface. In Gin v1.9.1, Engine.Run calls Go's default http.ListenAndServe, which constructs an HTTP server without application-level ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes limits. An unauthenticated client...

GHSA-W4C6-7R69-W7J9 klever-go: REST API slow-header connection exhaustion via Gin Engine.Run

Summary The Klever seednode REST API starts a Gin engine with Engine.RunrestAPIInterface. In Gin v1.9.1, Engine.Run calls Go's default http.ListenAndServe, which constructs an HTTP server without application-level ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes limits. An unauthenticated client...

CVE-2026-10580: Improper Authorization

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::getuserpermissions, which returns the same null sentinel f...

PT-2026-48347

Name of the Vulnerable Software and Affected Versions klever-go versions 1.7.14 through 1.7.17 Description The REST API in the seednode and node components is susceptible to a denial of service attack. This occurs because the application uses the Gin framework's Engine.Run function, which relies ...

autoreduce-db (22.0.0.dev21), autoreduce-qp (>=22.0.0.dev21, <=22.0.0.dev23) +5 more potentially affected by CVE-2026-48587 via django (3.2.10)

django PYPI version 3.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-db 22.0.0.dev21 - autoreduce-qp =22.0.0.dev21, =22.0.0.dev13, =22.0.0.dev29, =0.2.0, =1.0.1, =0.0.0.dev8, =0.0.0.dev13 Source cves:...

autoreduce-db (22.0.0.dev37), autoreduce-frontend (22.0.0.dev24) +6 more potentially affected by CVE-2026-48587 via django (4.0.6)

django PYPI version 4.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-db 22.0.0.dev37 - autoreduce-frontend 22.0.0.dev24 - autoreduce-qp 22.0.0.dev38 - autoreduce-rest-api 22.0.0.dev23 - autoreduce-scripts...

autoreduce-db (22.0.0.dev21), autoreduce-qp (>=22.0.0.dev21, <=22.0.0.dev23) +5 more potentially affected by CVE-2026-6873 via django (3.2.10)

django PYPI version 3.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-db 22.0.0.dev21 - autoreduce-qp =22.0.0.dev21, =22.0.0.dev13, =22.0.0.dev29, =0.2.0, =1.0.1, =0.0.0.dev8, =0.0.0.dev13 Source cves:...

EUVD-2026-33930

Improper Authentication in REST API in Collibra Agent, allows a remote unauthenticated attacker to access privileged functionality via exposed '/rest/ endpoints...

CVE-2026-10622: Undefined Security Weakness

Improper Authentication in REST API in Collibra Agent, allows a remote unauthenticated attacker to access privileged functionality via exposed '/rest/ endpoints...

CVE-2026-10215

A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/apiholidays.class.php of the component Leave Request REST API. The manipulation leads to improper authorization. The attack may be initiat...

CVE-2026-10215: Improper Authorization

A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/apiholidays.class.php of the component Leave Request REST API. The manipulation leads to improper authorization. The attack may be initiat...

Exploit for Improper Input Validation in Microsoft

CVE-2025-9209 – RestroPress Unauthenticated API Key & Token Ex...

CVE-2026-45577

Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present. In affected deployments, the REST auth middleware can resolv...

CVE-2026-45625 Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/sync for managing GitOps source repositories and their stored credentials. Eig...

CVE-2026-4290: Missing Authorization

The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/userid REST API endpoint in all versions up to, and including, 10.6.0. This is due to the checkpermission callback unconditionally returning true and the Database::delete...

CVE-2026-10056: Permissive Cross-domain Policy with Untrusted Domains

CORS misconfiguration in the REST API of Network Optix Nx Witness VMS before version 6.1.2, when running in the default Standard security mode, on Linux and Windows allows an unauthenticated remote attacker to steal the session token of an authenticated user and perform Administrator Account...

CVE-2026-45625: Missing Authorization

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/sync for managing GitOps source repositories and their stored credentials. Eig...

arcane 安全漏洞

Arcan is an open-source Docker management software developed by Arcane. Versions of Arcan prior to 1.19.0 contained security vulnerabilities. These vulnerabilities stemmed from multiple endpoints in the Huma-based REST API that did not call the checkAdmin helper function. Additionally, the...

CVE-2026-45342

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, LinkAce contains an Insecure Direct Object Reference vulnerability in the authorization policy layer that allows any authenticated user to modify resources owned by other users. The affected resource types are links, lists...