3124 matches found
CVE-2026-72790 SiYuan before v3.7.4 Information Disclosure via getNotebookInfo
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that...
CVE-2026-73406 Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLICENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...
CVE-2026-73301 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder...
CVE-2026-73293 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...
EUVD-2026-57312
Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...
grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads
A flaw in Grafana's API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service DoS...
The vulnerability of the API-endpoint component of VK WorkMail’s corporate email service allows a hacker to execute arbitrary commands.
The vulnerability of the API-endpoint component of VK WorkMail’s corporate email service is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
CVE-2026-4879: Missing Authorization
GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to...
PT-2026-71145
Name of the Vulnerable Software and Affected Versions Semaphore UI versions prior to 2.18.17 Semaphore UI versions prior to 2.19.5-beta2 Description Improper handling of the git url variable allows a project Manager or Owner to execute arbitrary OS commands within the server process. This occurs...
PT-2026-71245
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient publish-access checks in the 'getBlockAttrs' and 'batchGetBlockAttrs' endpoints allow attackers to retrieve block attributes from protected documents. By sending POST requests containing...
PT-2026-71235
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Sensitive configuration fields are not properly masked in the '/api/system/getConf' endpoint. This allows anonymous users or those with publish-reader permissions to retrieve the session-cookie signin...
PT-2026-71232
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the /api/notebook/getNotebookInfo endpoint. The system fails to perform proper authorization checks, allowing users with read-only roles or anonymous readers ...
PT-2026-71246
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An authentication bypass exists where the software fails to validate the publish-password tier. This allows anonymous readers to retrieve block-level content of password-protected documents and the...
CVE-2026-71475 Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path
A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL...
EUVD-2026-56855
OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...
CVE-2026-73085 Audiobookshelf: Refresh Token Accepted on Resource Endpoints
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to...
EUVD-2026-56553
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to...
CVE-2026-12074 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-72605
A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...