1563 matches found
PT-2026-86935
knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the...
CVE-2026-86119
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
CVE-2026-86119 Webstudio through 0.296.0 SSRF via /cgi proxy routes
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
EUVD-2026-71951
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
CVE-2026-86119
Webstudio through version 0.296.0 is affected by an unauthenticated server-side request forgery (SSRF) vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes. The root cause is that when the RESIZE_ORIGIN environment variable is unset, attackers can supply arbitrary URLs to thes...
CVE-2026-86119 Webstudio through 0.296.0 SSRF via /cgi proxy routes
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
CVE-2026-84901
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...
CVE-2026-84901 Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...
EUVD-2026-71868
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...
PT-2026-86352
šØ CVE-2026-84901 The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and dele...
GHSA-FGMR-7W36-9QFQ SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers
CVE: This vulnerability corresponds to CVE-2026-72796. Summary Several static-file routes in the server mux kernel/server/serve.go are registered with CheckAuth only and serve directories directly, without the publish-access checks, sensitive-path blocklist, or refuseToAccess rules that the REST...
EUVD-2026-57456
SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers...
EUVD-2026-45906
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path...
CVE-2026-84469
fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...
EUVD-2026-70806
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODEBROKERPING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses...
CVE-2026-85433 MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration
MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARECMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARECMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary address...
CVE-2026-85390
Checkmate through 3.11.0 omits the isAllowed role guard middleware on its maintenance-window, notification, and check-deletion routes, allowing users with a read-only role to perform administrative actions. A low-privileged attacker with a valid user-role session can create arbitrary maintenance ...
CVE-2026-85390 Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...