wlc may disclose API tokens to project-configured URLs

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...

CVE-2026-62364

The wlc Weblate command-line client is vulnerable to unauthorized API token disclosure in versions prior to 2.0.1 . If an unscoped API token is provided via WLC_KEY or --key without an explicit WLC_URL or --url, the application may automatically use a project-configured URL from files like .webla...

EUVD-2026-84823

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364 wlc may disclose API tokens to project-configured URLs

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

EUVD-2026-84550

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightragwebui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store r...

CVE-2026-86062 LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightragwebui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store r...

CVE-2026-86062

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightragwebui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store r...

CVE-2026-86062 LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightragwebui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store r...

CVE-2021-41805

CVE-2021-41805 Hashicorp Consul RCE через API HashiCorp Consul Enterprise до версии 1.8.17, 1.9.x до 1.9.11 и 1.10.x до 1.10.4 имеет некорректный контроль доступа. Токен ACL с разрешениями operator:write по умолчанию в одном пространстве имен может быть использован для непреднамеренного повышения...

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access

argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token. id:...

SiYuan <= 3.6.5 - Unauthenticated Path Traversal

SiYuan = 3.6.5 contains a path traversal via double URL-encoding in the /assets/ route publish mode port 6808, allowing unauthenticated attackers to read arbitrary files inside WorkspaceDir including conf/conf.json which exposes the API token and access auth code. id: CVE-2026-54066 info: name:...

CVE-2022-24112-POC

CVE-2022-24112-POC Apache APISIX 2.12.1 Удаленное выполнение кода путем обхода ограничения по IP и использования токена администратора AIP по умолчанию Полное руководство https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff...

LEAKEY

LEAKEY 🔑 LEAKEY — это инструмент для проверки утекших API-токенов/ключей, обнаруженных в ходе пентестов и Red Team мероприятий. Скрипт очень полезен для баг-хантеров для проверки и определения влияния утекших учетных данных. LEAKEY использует файл сигнатур на основе JSON, расположенный в...

CVE-2023-48084

CVE-2023-48084 Исправляет нарушенный синтаксис в POC, в первую очередь неправильный импорт и неверное обращение к функциям API. Автоматизирует получение APIToken, сохраняет токен в переменную и передаёт его в исправленный POC. https://github.com/Hamibubu/CVE-2023-48084 Если по какой-то причине эт...

EUVD-2026-83569

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-9613

CVE-2026-9613 affects the Datalogics Ecommerce Delivery WordPress plugin in all versions up to and including 2.6.65 . The root cause is improper authorization verification in multiple AJAX actions (datalogics_create_shipping / datalogics_cancel_shipping), allowing authenticated users with subscri...

CVE-2026-54676

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

CVE-2026-54676

Scoold , a Q&A and knowledge-sharing platform for teams, is affected by an authorization bypass in ApiController.getPostReplies() (file ApiController.java). Prior to 1.69.0 , the GET /api/posts/{id}/answers endpoint did not call canAccessSpace before returning reply data, allowing users holding a...

CVE-2026-88795

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...