136 matches found
CVE-2026-3131
Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permission to access sensitive connection data...
org.glassfish.main.admingui:console-commandrecorder-plugin (>=7.0.16, <=9.0.0-m3), org.glassfish.main.featuresets:debug (>=6.2.5, <=9.0.0-m3) +5 more potentially affected by CVE-2025-14340 via org.glassfish.main.admin:rest-service (>=5.0.1, <=9.0.0-m3)
org.glassfish.main.admin:rest-service MAVEN version =5.0.1, =7.0.16, =6.2.5, =7.1.0-m1, =7.1.0-m1, =5.0.1, =5.0.1, =5.0.1, =9.0.0-m3 Source cves: CVE-2025-14340 Source advisory: SNYK:JAVA-ORGGLASSFISHMAINADMIN-15323111...
CVE-2026-1894 WeKan REST API checklistItems.js Checklist REST Bleed improper authorization
A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results in improper authorization. Remote exploitation of the atta...
CVE-2023-31011
NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges and information disclosure...
CVE-2023-31012
NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges and information disclosure...
CVE-2024-2244
REST service authentication anomaly with “valid username/no password” credential combination for batch job processing resulting in successful service invocation. The anomaly doesn’t exist with other credential combinations...
CVE-2025-67715 Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue...
CVE-2025-12655
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint /wp-json/hippoo/v1/wc/token/savecallback/tokenid being registered with...
CVE-2025-12847
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint...
EUVD-2016-5974
Malware in sbrugna...
EUVD-2012-4874
Malware in sbrugna...
EUVD-2023-35349
Malicious code in bioql PyPI...
EUVD-2023-35350
Malicious code in bioql PyPI...
EUVD-2022-6854
Malicious code in bioql PyPI...
EUVD-2024-28060
Malicious code in bioql PyPI...
EUVD-2023-35346
Malicious code in bioql PyPI...
EUVD-2024-27200
Malicious code in bioql PyPI...
EUVD-2022-4130
Malicious code in bioql PyPI...