Fail-Open Architecture for Secure Inline Protection on Azure

Every inline deployment introduces a tradeoff: enhanced inspection versus increased risk of downtime. Inline protection is important, especially for APIs, which are now the most targeted attack surface, but so is consistent uptime and performance. This is where a fail-open architecture comes in...

PT-2025-29528 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 9.0.0 through 11.8.99 Description: Directus is a real-time API and App dashboard for managing SQL database content. The exact Directus version number is exposed by the /server/specs/oas endpoint without authentication in...

Understanding the NCSC’s New API Security Guidance

Legislative, regulatory, and advisory bodies the world over are waking up to the importance of API security. Most recently, the UK’s National Cyber Security Centre NCSC has published detailed guidance on best practices for building and maintaining secure APIs. In this blog, we’ll break down that...

CVE-2025-3396 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests...

CVE-2025-7204 Exposure of password hashes via API responses in ConnectWise PSA

In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encrypted password hashes for other users. Authenticated users...

PT-2025-28949 · Ruckus · Network Director

Name of the Vulnerable Software and Affected Versions: RUCKUS Network Director versions prior to 4.5 Description: RUCKUS Network Director RND stores passwords in a recoverable format. Recommendations: Update RUCKUS Network Director to version 4.5 or later...

Inside the AI Threat Landscape: From Jailbreaks to Prompt Injections and Agentic AI Risks

AI has officially moved out of the novelty phase. What began with people messing around with LLM-powered GenAI tools for content creation has rapidly evolved into a complex web of agentic AI systems that form a critical part of the modern corporate landscape. However, this transformation has give...

PT-2025-28412 · Unknown · Quiter Gateway

Name of the Vulnerable Software and Affected Versions: Quiter Gateway versions prior to 4.7.0 Description: The issue allows an attacker to retrieve, create, update, and delete databases through the "pagina.filter.categoria mensaje" in the "/QuiterGatewayWeb/api/v1/sucesospagina" endpoint. This...

Local File Inclusion (LFI)

microweber/microweber is vulnerable to Local File Inclusion LFI. The vulnerability is due to insufficient path validation and inadequate restrictions in the backup management API, allowing authenticated users to read arbitrary files via crafted requests to the upload and download endpoints...

What CISA’s BOD 25-01 Means for API Security and How Wallarm Can Help

The US government has taken another significant step towards strengthening cloud security with the release of CISA’s Binding Operational Directive BOD 25-01. Aimed at improving the security posture of federal cloud environments, BOD 25-01 mandates robust configuration, visibility, and control...

Operationalize Day-2 Services for API Security and Microsegmentation

Learn how to turn post-deployment services into a revenue opportunity and provide ongoing value for your customers with industry-leading tools and service playbooks...

CVE-2025-6732

The CVE-2025-6732 entry concerns UTT HiPER 840G (versions up to 3.1.1-190328) where the API’s /goform/setSysAdm component uses strcpy on the passwd1 argument. This insecure operation enables a buffer overflow, with remote attack potential and high impact to confidentiality, integrity, and availab...

Study Reveals API Security Gaps in Asia-Pacific Compliance Programs

...

Beyond Traditional Threats: The Rise of AI-Driven API Vulnerabilities

AI has had dramatic impacts on almost every facet of every industry. API security is no exception. Up until recently, defending APIs meant guarding against well-understood threats. But as AI proliferates, automated adversaries, AI-crafted exploits, and business logic abuse have complicated matter...

Closing the Loop on API Security: How Imperva Helps You Expose, Contain, and Mitigate Business Logic Threats

In a world powered by APIs, waiting for an attack is waiting too long. Business logic risks like Broken Object Level Authorization BOLA don’t announce themselves with obvious signatures or malware. They hide in plain sight within normal-looking traffic and by the time a BOLA exploit turns into a...

MAL-2025-5483 Malicious code in wonderland-api-security-plugin (npm)

The package communicates with a domain associated with malicious activity...

Enhancements to Akamai API Security, Q2 2025

Akamai API Security updates 3.48 and 3.49 include Compliance Dashboard enhancements, integration with Zuplo API gateway, and expanded sensor coverage...

CVE-2025-25215

CVE-2025-25215 affects Dell ControlVault3 and ControlVault3 Plus; an arbitrary-free vulnerability resides in the cv_close path due to insufficient session validation. Talos’ analysis shows an attacker can forge a fake session on the CV firmware (for sessions allocated on the device heap) and trig...

API Security Under Federal Scrutiny: A Wake-Up Call for CIOs

...

CVE-2025-27505

GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension e.g., rest.html. The REST API index can...