CVE-2026-80208 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxi...

Automattic: Reflected XSS in https://www.intensedebate.com/js/getCommentLink.php

Hey there, I have found a reflected dom xss vulnerability in your website www.intensedebate.com, the posttitle parameter is vulnerable. --------------------------------------------------------------------------------------------------------------------------------------------------- Full url:...

Basecamp: User can upload files even after closing his account

Summary: =========================== Hello @basecamp This is my first report on your program and I hope to end well : . I was testing https://app.hey.com/ and I my account has been closed, so I back to the requests history, and I tried to send these requests even my account closed. and I found th...

#OpPayPal - Anonymous calls for boycott of PayPal for blocking Wikileaks

OpPayPal - Anonymous calls for boycott of PayPal for blocking Wikileaks The Latest Operation could be a major departure into legal direct action for Anonymous, LulzSec and AntiSec. If so, this is one to watch with great interest. The campaign marks something of a departure for LulzSec and...