GHSA-F7Q6-7RQ9-3PHX Duplicate Advisory: Uncaught Exception processing HTTP Headers in SurrealDB

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m24x-r6q3-2vp9. This link is maintained to preserve external references. Original Description SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containin...

Exploit for CVE-2026-60137

CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated...

wp2shell

wp2shell Pre-authentication RCE exploit for WordPress Core RE...

wp2shell-poc

wp2shell-poc Independent proof-of-concept for the unauthentic...

CVE-2024-58368: Uncaught Exception

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server...

wp2shell-poc

wp2shell PoC The first ever poc of the pre-auth timing-based...

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

CVE-2026-63030: Interpretation Conflict

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

VulnCheck KEV: CVE-2026-63030

WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137...

WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE

This module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137 is an SQL injection in...

CVE-2026-62235: Missing Authorization

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...

CVE-2026-16106: Insufficient Granularity of Access Control

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

CVE-2026-44174

Kirby CMS (versions prior to 4.9.1 and 5.4.1) exposes REST API search and collection queries that did not validate model attributes, allowing authenticated users to invoke arbitrary model methods (e.g., password(), root(), loginPasswordless(), delete()) via collection endpoints. This can disclose...

Insertion of Sensitive Information Into Sent Data

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through OrganizationInvitationResource.toRepresentation in...

Insertion of Sensitive Information Into Sent Data

Overview @keycloak/keycloak-admin-ui is a This project is the next generation of the Keycloak Admin UI. It is written with React and PatternFly 4 and uses Vite. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through...

CVE-2026-59237: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key CWE-639 in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company tenant via a sequential numeric i...

NPM: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

NPM: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/path — arbitrary host file read/write/delete vulnerability discovered by ? in WordPress Npm obsidian-local-rest-api versions 4.1.3...

MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs

Unvalidated notetype Parameter in mcissueupdate SOAP Endpoint Allows creation of TIMETRACKING and REMINDER Notes. The SOAP path passes the user-supplied notetype integer directly to bugnoteadd without validating that the user is authorized to create that type of note. If the user's access level i...

Authorization Bypass Through User-Controlled Key

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the REST and SOAP API update process. An attacker can assign unreleased product versions by sending crafted API requests with insufficient...

GHSA-M7PH-9558-MRX3 MantisBT: REST API unauthorized Issue status change

A MantisBT user having $gupdatebugthreshold UPDATER by default can change an Issue's Status via REST and SOAP API, even if the $gsetstatusthreshold config is set to a higher level DEVELOPER by default. Impact Unauthorized change in Issue workflow. Patches...