jshound

jshound Recover every request a web app is built to make from the JavaScript it ships: method, URL, body, content type and headers. A single page app's JavaScript bundle contains every API request the app can make. Given a URL, jshound finds the app's bundle, crawls all of it, lazily loaded chunk...

CVE-2026-21830 HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints...

authcov

AuthCov Web app authorisation coverage scanning. Introduction AuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a...

trident

trident The Trident project is an automated password spraying tool developed to meet the following requirements: the ability to be deployed on several cloud platforms/execution providers the ability to schedule spraying campaigns in accordance with a target’s account lockout policy the ability to...

PT-2026-128223

HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints...

CVE-2026-55842

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern"" with setAllowCredentialstrue, causing Spring to reflect any requesting origin while allowing cookie...

EUVD-2026-102311

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern"" with setAllowCredentialstrue, causing Spring to reflect any requesting origin while allowing cookie...

CVE-2026-55842

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern"" with setAllowCredentialstrue, causing Spring to reflect any requesting origin while allowing cookie...

CVE-2026-55842: Origin Validation Error

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern"" with setAllowCredentialstrue, causing Spring to reflect any requesting origin while allowing cookie...

CVE-2026-110222 Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup

Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...

PT-2026-111846

Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...

CVE-2026-85489

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

CVE-2026-85489

An authentication flaw in the Brocade ASCG administrative management service component allows unauthenticated network users to issue direct API requests. This vulnerability enables attackers to perform privileged actions, such as accessing sensitive system configuration mapping data , modifying m...

Information Exposure

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Information Exposure via the DirProtections.listing API command, which returns bcrypt password hashes for protected-directory users. An attacker can obtain sensitive credential...

CVE-2026-87814

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

CVE-2026-87813

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

CVE-2026-87812

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-87812: Improper Neutralization of Input During Web Page Generation

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-78362

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site...

Security Bulletin: Langflow OSS is affected by server-side request forgery in provider validation and API request functionality

Summary Langflow OSS includes outbound network request functionality for provider validation and API request execution. Weaknesses in request destination validation and enforcement could allow authenticated users to induce requests to unintended internal or external network locations, which may...