org.http4k:http4k-api-graphql (5.44.0.0), org.http4k:http4k-api-jsonrpc (5.44.0.0) +180 more potentially affected by unknown CVE via org.http4k:http4k-core (5.44.0.0)

org.http4k:http4k-core MAVEN version 5.44.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-api-graphql 5.44.0.0 - org.http4k:http4k-api-jsonrpc 5.44.0.0 - org.http4k:http4k-api-jsonsche...

org.http4k:http4k-api-graphql (5.42.0.0), org.http4k:http4k-api-jsonrpc (5.42.0.0) +178 more potentially affected by unknown CVE via org.http4k:http4k-core (5.42.0.0)

org.http4k:http4k-core MAVEN version 5.42.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-api-graphql 5.42.0.0 - org.http4k:http4k-api-jsonrpc 5.42.0.0 - org.http4k:http4k-api-jsonsche...

org.http4k.pro:http4k-incubator-db (v6.3.0.0), org.http4k.pro:http4k-mcp-sdk (v6.3.0.0) +173 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (v6.3.0.0)

org.http4k:http4k-core MAVEN version v6.3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k.pro:http4k-incubator-db v6.3.0.0 - org.http4k.pro:http4k-mcp-sdk v6.3.0.0 -...

org.http4k.pro:http4k-incubator-db (v6.4.1.0), org.http4k.pro:http4k-mcp-sdk (v6.4.1.0) +173 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (v6.4.1.0)

org.http4k:http4k-core MAVEN version v6.4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k.pro:http4k-incubator-db v6.4.1.0 - org.http4k.pro:http4k-mcp-sdk v6.4.1.0 -...

CVE-2025-27236 User information disclosure via api_jsonrpc.php on method user.get with param search

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to...

CVE-2023-45826

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

PT-2023-29714

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 2.4-beta-4 Description Leantime is an open source project management system. A userId variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully...

SUSE CVE-2019-15132

Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of...

UBUNTU-CVE-2022-26148

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the apijsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in...