CVE-2026-53552: Authorization Bypass Through User-Controlled Key

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the...

CVE-2026-47717: Insertion of Sensitive Information Into Sent Data

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue...

CVE-2026-73293: Improper Privilege Management

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...

GHSA-Q3W6-Q3HC-C5X6 FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

Summary The GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Details File: server/api/projects/index.js javascript prjApp.get"/api/project", secureFnc, functionreq, res const permission = checkGroupsFncreq;...

FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

Summary The GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Details File: server/api/projects/index.js javascript prjApp.get"/api/project", secureFnc, functionreq, res const permission = checkGroupsFncreq;...

golang-cicd-poc

Golang CI/CD POC Project POC project for trying out different...

Malicious code in typescript-api-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 398036095e479d925d07bcf55655437c9689808b7e019efbbfc071fcd4c459ac The OpenSSF Package Analysis project identified 'typescript-api-project' @ 10.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2025-41814 Malicious code in typescript-api-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 398036095e479d925d07bcf55655437c9689808b7e019efbbfc071fcd4c459ac The OpenSSF Package Analysis project identified 'typescript-api-project' @ 10.0.1 npm as malicious. It is considered malicious because: - The...

CentralizedFirewall - Provides A Firewall Manager API Designed To Centralize And Streamline The Management Of Firewall Configurations

Firewall Manager API Project Installation Follow these steps to set up and run the API project: 1. Clone the Repository git clone https://github.com/adriyansyah-mf/CentralizedFirewall cd CentralizedFirewall 2. Edit the .env File Update the environment variables in .env according to your...

CVE-2022-32170: Improper Authorization

The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=$userId”...