2964 matches found
CVE-2026-86178 Pixelfed through 0.12.9 Unauthorized Story Access via API
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...
CVE-2026-86123
SQL Chat is a database connectivity tool that exposes four unauthenticated API endpoints under /api/connection (specifically execute.ts and test.ts). These endpoints accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts, effective...
SUSE CVE-2026-7387
Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 Mattermost fails to require role-management authorization when setting the schemeadmin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to escalate themselv...
SUSE CVE-2026-67439
OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user...
PT-2026-86386
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...
EUVD-2026-60376
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds...
EUVD-2026-57455
SiYuan: Embedded transclusion block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers...
GHSA-F2RW-W22V-54VH SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers
CVE: This vulnerability corresponds to CVE-2026-72797. Summary POST /api/notebook/getEncryptedNotebookStatus returns the identifier, name, and current lock state of every encrypted notebook, with no publish-access filtering. The route is registered CheckAuth only, no CheckReadonly, no...
CVE-2026-12878
A flaw was found in the Codefresh platform. An authenticated user can exploit an API endpoint to elevate their privileges to administrative permissions, potentially gaining full control over the platform...
CVE-2026-85688 TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer
TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...
EUVD-2026-71137
TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...
Unverified Password Change
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Unverified Password Change via the user control panel API endpoint. An attacker can gain unauthorized access to user accounts by submitting a crafted PU...
Unverified Password Change
Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Unverified Password Change via the user control panel API endpoint. An attacker can gain unauthorized access to user accounts by submitting a crafted PU...
EUVD-2026-71015
phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers ca...
CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change
phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...
CVE-2026-85591
phpMyFAQ versions before 4.1.8 contain an authentication bypass in the user control panel API endpoint . The root cause is that the password-change handler does not verify the current password before accepting a new one. An attacker with an existing valid session can submit a PUT request to the u...
PT-2026-85574
Name of the Vulnerable Software and Affected Versions TEN Framework version 0.11.71 Description The TMAN Designer component contains flaws allowing unauthenticated users to read and write arbitrary files. By sending POST and PUT requests to the '/api/designer/v1/file-content' endpoint, an attacke...
Flextype CMS 1.0.0-alpha.3 Authentication Bypass
Flextype CMS version 1.0.0-alpha.3 contains an authentication validation vulnerability in the API request-processing functionality. API endpoints may declare accesstoken as a required parameter, but the required-parameter validation only verifies that the corresponding key exists in the supplied...