EUVD-2026-64937

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade to version 1.20.0, which fixes the issue...

CVE-2026-75099 Apache Allura: Unauthenticated REST disclosure

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade to version 1.20.0, which fixes the issue...

CVE-2026-75099 Apache Allura: Unauthenticated REST disclosure

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade to version 1.20.0, which fixes the issue...

CVE-2026-75099

Apache Allura versions through 1.19.1 are vulnerable to an unauthenticated REST disclosure of certain content items. This vulnerability allows an unauthorized actor to access sensitive information via the REST interface. Users are recommended to upgrade to version 1.20.0 , which contains the fix ...

CVE-2026-67602

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

CVE-2026-67602

phpIPAM before 1.8.2 contains an authentication bypass in its REST API caused by an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, so an entry written during an app_id lookup can satisfy a subsequent app_code lookup. This al...

EUVD-2026-64889

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

CVE-2026-67602 phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

CVE-2026-67602 phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

CVE-2026-67602 phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

CVE-2026-68517

A flaw was found in Glances. The REST API's Cross-Origin Resource Sharing CORS protection mechanism incorrectly validates allowed origins. This vulnerability occurs because the corsorigins guard uses exact list equality instead of checking for wildcard membership. A remote attacker could exploit...

WordPress Everest Forms plugin < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints vulnerability

Unauthenticated Missing Authorization via Site Assistant REST Endpoints vulnerability discovered by Pedro Pinho in WordPress Plugin Everest Forms versions 3.5.0...

WordPress Content Protector (Passster) plugin < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass vulnerability

Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass vulnerability discovered by Erwan LR WPScan in WordPress Plugin Passster versions 4.3.9...

WordPress Dokan plugin < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint vulnerability

Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint vulnerability discovered by Usama Arshad in WordPress Plugin Dokan versions 5.0.14...

WordPress NewPath WildApricotPress Add-on - Member Directory plugin <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API vulnerability

WordPress NewPath WildApricotPress Add-on - Member Directory plugin = 1.0.0 - Unauthenticated Member PII Disclosure via REST API vulnerability discovered by Huynh Kien Minh in WordPress Plugin NewPath WildApricotPress Add-on for Member Directory versions = 1.0.0...

K000163050: Spring REST Docs vulnerability CVE-2026-40991

Security Advisory Description When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the...

PT-2026-81000

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

PT-2026-81001

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description An improper authorization issue exists in the payments REST API delete endpoint. Authenticated attackers with invoice-deletion rights can bypass the required payment-issuance rights check to...

CVE-2026-71504: Missing Authorization

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply...

CVE-2026-67602: Use of Incorrectly-Resolved Name or Reference

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...