CVE-2026-15658

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record...

CVE-2026-23981

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs dashboards to associate the char...

CVE-2026-52680 Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write

Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to...

CVE-2026-52680

Apache Kyuubi versions 1.7.0 through 1.11.1 are vulnerable to a Path Traversal vulnerability (CWE-22, CWE-73) in the REST batch multipart upload handling. Specifically, the Utils.writeToTempFile function in kyuubi-common fails to normalize or contain the client-supplied filename during a POST /ap...

CVE-2026-44613 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

EUVD-2026-51160

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-44613

Apache Zeppelin (versions 0.6.0 through 0.12.0 ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause lies in a default CORS configuration that permits cross-origin state-changing requests and accepts text/plain request bodies. Specifically, the CorsFilter, CorsUtils, and RES...

CVE-2026-44613 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-44613

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-44613 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-15658

A vulnerability in the foreUP golf management platform's customer REST API allows authenticated, low-privilege customers to perform a Broken Object Level Authorization (BOLA) attack. By substituting a golfer_id in the request path while using their own valid JSON Web Token (JWT) , an attacker can...

CVE-2026-16308 IBM Enterprise Build of Quarkus is affected by a DoS vulnerability

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes...

CVE-2026-16308

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes...

io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service

A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine JVM heap memory...

CVE-2026-44097

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...

CLEANSTART-2026-JZ53476 Security fixes in kserve-rest-proxy 0.12.0-r1

Package kserve-rest-proxy version 0.12.0-r1 fixes 6 vulnerabilities: CVE-2025-68121, CVE-2026-27142, CVE-2026-25679, CVE-2025-58190, CVE-2025-47911...

CVE-2026-14923

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

CVE-2026-14226

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by a DoS vulnerability

Summary IBM Enterprise Build of Quarkus is affected by a DoS vulnerability in Quarkus REST Vulnerability Details CVEID:CVE-2026-16308 DESCRIPTION: Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes. CWE:CWE-770...

CVE-2026-14226

The Easy Appointments WordPress plugin (versions before 3.12.28 ) contains a vulnerability where an appointment-listing REST endpoint fails to require a sufficient capability. It only checks for a capability held by every authenticated user, allowing users with subscriber-level access to view all...