X-force

IBM X-Force Exchange library | IBM Security X-FORCE Exchange library in Python 3. Search: threatactivities, threatgroups, malwareanalysis, collector and industries. For others applications. See ---|--- Install pip3 install XForce Use Using you APIKEY make a basic authentication. See . After make ...

CVE-2025-492030

CVE-2025-492030 Security Advisory: CVE-2025-492030 Overview A critical vulnerability has been identified in the SecureVPN application, which allows for account takeover through a vulnerable API endpoint. This flaw could enable attackers to gain unauthorized access to user accounts, potentially...

CVE-2026-96385

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0...

OpenMetadata - Authentication Bypass

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The JwtFilter handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request...

EUVD-2026-107819

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0...

CVE-2026-96385 REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0...

CVE-2026-96385 REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0...

CVE-2026-96385 REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0...

CVE-2026-96385

The REST & JSON API Authentication for Drupal module (versions 0.0.0 through 3.2.0) contains an authentication bypass vulnerability. The root cause is that the module fails to sufficiently validate authentication requirements for all API requests, which can allow an attacker to bypass the intende...

CVE-2021-36460

CVE-2021-36460 NVD CVE-2021-36460: https://nvd.nist.gov/vuln/detail/CVE-2021-36460 MITRE CVE-2021-36460: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-36460 CWE-836: Use of Password Hash Instead of Password for Authentication The VeryFitPro app Android: com.veryfit2hr.second, iOS =3.3.7...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale System and the Management GUI are now fixed in 6.2.3.6 or higher and 7.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale System and the Management GUI and could provide weaker-than-expected security, are now fixed in Storage Scale 6.2.3.6 or higher and 7.0.1.1 or higher. Vulnerability Details CVEID:CVE-2026-13460 DESCRIPTION: IBM Storage Scal...

Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

Overview On September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding CWE-177. An...

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability...

CVE-2026-88795: Improper Control of Generation of Code

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

PT-2026-94171

Name of the Vulnerable Software and Affected Versions wpShopGermany IT-RECHT KANZLEI versions prior to 2.4 Description The plugin fails to generate API authentication tokens securely. The token is derived from data controlled by the requester and is created as a side effect of the validation chec...

CVE-2026-92003 MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other...

CVE-2026-52827 Kimai: Two-factor authentication bypass on the Kimai API

Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAISESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with ISAUTHENTICATED and...

[SECURITY] Fedora 45 Update: perl-Net-OAuth-0.33-2.fc45

Perl implementation of OAuth, an open protocol to allow secure API authentication in a simple and standard method from desktop and web applications. In practical terms, a mechanism for a Consumer to request protected resources from a Service Provider on behalf of a user...

CVE-2026-17038

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading an...

CVE-2026-17038 Use of Hard-coded Credentials in drEryk Gabinet

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading an...