3175 matches found
PT-2026-84473
Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description A privilege escalation issue exists in the API endpoint of AOS-CX. An authenticated user with low-privilege operator permissions can access sensitive information from the system, provided a...
PT-2026-84414
Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to make limited unauthorized modifications to the underlying operating system and disrupt the...
PT-2026-84434
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system...
CVE-2026-73755: Improper Privilege Management
A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, after a required user action, to access sensitive information from the vulnerable system...
PT-2026-84484
Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description Command injection flaws in the API endpoint allow an authenticated remote attacker with administrative privileges to inject and execute arbitrary commands as a privileged user on the underlyin...
PT-2026-84494
Name of the Vulnerable Software and Affected Versions AOS-CX switches affected versions not specified Description An issue exists in the API endpoint of AOS-CX switches that may allow an unauthenticated remote actor to bypass authentication controls. Recommendations At the moment, there is no...
PT-2026-84490
Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description An unauthenticated Denial-of-Service DoS issue exists in the API endpoint of AOS-CX. Successful exploitation allows an attacker to interrupt the normal operation of the affected service...
PT-2026-84470
Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description An unauthenticated arbitrary file write issue exists in an API endpoint. This allows an attacker to write arbitrary files to the underlying operating system, which could potentially lead to...
CVE-2026-73752: Improper Limitation of a Pathname to a Restricted Directory
An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution...
CVE-2026-82835
A vulnerability in caoqianming django-vue-admin 1.0 allows improper access control through manipulation of the file_id argument at the /api/file/ endpoint. The attack is executable remotely with low privileges and no user interaction . Exploit code has been made public and is rated as proof-of-co...
CVE-2026-82816
dibo-software diboot 3.8.0 contains an authorization bypass in the AI Session Endpoint (/api/ai-session/). The flaw allows a remote attacker with low privileges to bypass authorization with low complexity and no user interaction, impacting confidentiality, integrity, and availability at a low lev...
CVE-2025-61162
A flaw was found in Cohere North AI. This incorrect access control vulnerability allows a remote attacker to send a specially crafted request to a specific API endpoint. This action enables the attacker to arbitrarily overwrite user information. The primary impact is unauthorized modification of...
WordPress Newsletters plugin < 4.17 - Unauthenticated API Access vulnerability
Unauthenticated API Access vulnerability discovered by Erwan LR WPScan in WordPress Plugin Newsletters versions 4.17...
CVE-2026-55485 Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...
EUVD-2026-67858
Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...
CVE-2026-55485 Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...
Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields
Impact A vulnerability was found in Graylog's API endpoint for retrieving system catalog entity titles. Authenticated users could retrieve database fields of supported entities by sending a custom API request. These fields can include e.g. the password hash of a user but not the password itself,...
GHSA-575R-357H-FHCH Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
Impact The API endpoint for updating asset maintenance records allows an authorized user to change the assetid of an existing maintenance record to an asset outside their company scope. In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or...
BIT-GITEA-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
CVE-2026-61802
Wazuh (open-source XDR/SIEM platform), versions 4.14.0 through 4.14.6 , contains a configuration-redaction gap: the GET /cluster/local/config endpoint is gated only by cluster:read permission and lacks the mask_sensitive_config decorator that all sibling config-read endpoints carry. As a result, ...