CVE-2026-72914: Asymmetric Resource Consumption (Amplification)

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-72588: Observable Response Discrepancy

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...

PT-2026-76473

Summary DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user's chat id could therefore abort that user's running model response, title generation or tag generation. The deletio...

Prometheus CVE-2026-42151 Secret Disclosure Detect

Detects CVE-2026-42151 in Prometheus 2.48.0–3.5.2 and 3.6.0–3.11.2: OAuthConfig.ClientSecret was a plain Go string instead of configutil.Secret, so /api/v1/status/config and /-/config emit the real Azure AD clientsecret instead of redacting it as ''. !/usr/bin/env python3 -- coding: utf-8 --...

Snipe-IT CVE-2026-37709 File Upload Detect

Detects CVE-2026-37709 in Snipe-IT ≤ 8.4.0 fixed in 8.4.1: POST /api/v1/objecttype/id/files checks the view permission instead of update, so any API user with view-only access can upload files to visible objects. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Snipe-IT CVE-2026-37709 view-onl...

CVE-2026-10547: Improper Access Control

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/flowid/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized...

PT-2026-68259

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description Insufficient ownership validation in the deprecated 'POST /api/v1/build/flow id/vertices' endpoint allows an authenticated user to inject arbitrary graph data into a shared cache for a...

PT-2026-68041

Name of the Vulnerable Software and Affected Versions changedetection.io affected versions not specified Description The REST API resources are protected by an @auth.check token decorator that validates the x-api-key header. However, the Spec resource registered at the '/api/v1/full-spec' endpoin...

PT-2026-68099

Name of the Vulnerable Software and Affected Versions InvoiceNinja version 5-stable Description An authenticated user with invoice creation permissions can inject HTML or JavaScript payloads into the terms field of an invoice or quote. This occurs because the application renders this field in the...

CVE-2026-71270: Server-Side Request Forgery (SSRF)

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...

PT-2026-68153

Name of the Vulnerable Software and Affected Versions go-shiori affected versions not specified Description An authenticated user can trigger the server to make outbound requests to internal-only services, cloud metadata endpoints, or other network-restricted resources. This occurs because the...

CVE-2026-71203: Missing Authentication for Critical Function

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

PT-2026-68143

Name of the Vulnerable Software and Affected Versions Stirling-PDF affected versions not specified Description The POST /api/v1/convert/url/pdf endpoint in ConvertWebsiteToPDF.java lacks Server-Side Request Forgery SSRF protections. While the endpoint verifies that the initial URL resolves to a...

PT-2026-68291

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description An authenticated attacker can perform a Path Traversal attack via the Knowledge Bases API endpoint POST /api/v1/knowledge bases. This issue arises because the system uses user-supplied...

CVE-2026-70478

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...

CVE-2026-69262

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, "DELETE /api/v1/chatflows/:id" authorized requests with checkAnyPermission'chatflows:delete,agentflows:delete', so possession of either permission was sufficient to reach the delete path. The...

Missing Authorization

Overview flowise-ui is a Affected versions of this package are vulnerable to Missing Authorization in the /api/v1/files route, which lacks proper permission checks for file listing and deletion operations. An attacker can access and remove files belonging to other workspaces within the same...

Missing Authorization

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Missing Authorization in the /api/v1/files route, which lacks proper permission checks for file listing and deletion operations. An attacker can access and remove files belonging to other workspaces within...

authx (0.1.4), carml (>=21.0.0, <=21.1.0) +19 more potentially affected by CVE-2026-69248 via cryptography (36.0.0)

cryptography PYPI version 36.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - authx 0.1.4 - carml =21.0.0, =0.2.2, =0.0.2, =1.0.0, =0.0.3, =0.19.0, =0.9.0, =1.0.10, =1.0.2, =0.7.0, =0.8.4 and more Source cves:...

c7n-azure (0.7.10), c7n-openstack (0.1.1) +40 more potentially affected by CVE-2026-69248 via cryptography (3.4.6)

cryptography PYPI version 3.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - c7n-azure 0.7.10 - c7n-openstack 0.1.1 - combocurve-api-v1 =0.1.0, =2.0.0rc1, =0.1.6.1, =0.0.3, =0.1.0, =0.2.8, =0.5.0, =0.10.0, =1.0.0...