15293 matches found
CVE-2026-48528
CVE-2026-48528 affects Metacat versions 2.0.0–3.4.0 and describes an unauthenticated SQL injection in the /cn/v1/object and /cn/v2/object REST endpoints due to unsanitized nodeId input. The backend SQL queries concatenate user input, enabling arbitrary data extraction from PostgreSQL and potentia...
WordPress User Access Manager plugin < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API vulnerability
Unauthenticated Restricted Content Disclosure via REST API vulnerability discovered by Farid Narimanov in WordPress Plugin User Access Manager versions 2.3.15...
SUSE CVE-2026-73228
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...
SUSE CVE-2026-73229
Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py AdminRenderer.render uses overridemethod to simulate GET and directly invokes view.get without view.checkpermissions while rendering an invalid write...
EUVD-2026-58504
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...
PT-2026-76555
Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.41.3 Description Authenticated users can perform server-side requests to internal services and cloud metadata. This occurs because automation steps for outgoing webhooks, Zapier, n8n, Slack, and Discord use...
PT-2026-75931
Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...
CVE-2026-72855
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...
CVE-2026-72855
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...
CVE-2026-72855
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections via DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses...
CVE-2026-72855 Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...
CVE-2026-72855 Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...
CVE-2026-72855 Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...
CVE-2026-13460
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...
CVE-2026-13460
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...
CVE-2026-13460 The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...
CVE-2026-13460 The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...
EUVD-2026-58361
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...
CVE-2026-13460
CVE-2026-13460 affects IBM Storage Scale GUI, with versions 5.2.3.0–5.2.3.8 and 6.0.0.0–6.0.1.0 containing a hardcoded token in the GUI source used for inter-node cluster communication and REST API authentication. The security bulletin indicates fixes in 5.2.3.9 or later and 6.0.1.1 or later. Rem...