EUVD-2024-26983

Malicious code in bioql PyPI...

EUVD-2023-54922

Malicious code in bioql PyPI...

CVE-2025-34218

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 VA/SaaS deployments expose internal Docker containers through the gw Docker instance. The gateway publishes a /meta endpoint which lists every micro‑service container...

PT-2025-36462

CVE ID: CVE-2025-0005 Published: 2025-05-20T00:00:00.000Z Severity: HIGH 7.5/10 Description Information disclosure vulnerability in the API Gateway v7.2.0 allows unauthenticated remote attackers to access sensitive information via a crafted HTTP request. Root Cause Improper access control in API...

NestJs-Microservices-POC

NestJS Microservices Proof of Concept A comprehensive demonst...

Malicious code in aws-api-gateway-js-client (npm)

The package aws-api-gateway-js-client was found to contain malicious code...

MAL-2025-15222 Malicious code in aws-api-gateway-js-client (npm)

The package aws-api-gateway-js-client was found to contain malicious code...

CVE-2025-52554

n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential...

CVE-2025-52554

n8n (workflow automation platform) had an authorization vulnerability affecting the /rest/executions/:id/stop endpoint prior to version 1.99.1. An authenticated user could stop workflow executions they did not own or that were not shared with them, potentially disrupting business processes. The i...

Enhancements to Akamai API Security, Q2 2025

Akamai API Security updates 3.48 and 3.49 include Compliance Dashboard enhancements, integration with Zuplo API gateway, and expanded sensor coverage...

CVE-2024-46549

An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating devices owned by other users...

CVE-2024-24753

Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relie...

CVE-2022-31041

Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users e.g. only PDF / Excel / .... The input validation of uploaded fil...

CVE-2019-15631

Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers to execute arbitrary code...

CVE-2024-46549

An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating devices owned by other users...

CVE-2024-46549

CVE-2024-46549 affects TP-Link Kasa KP125M v1.0.3 via the TP-Link MQTT Broker and API gateway. The issue permits impersonation of other users’ devices to establish connections, with confidentiality and integrity impact (C/H; I/H) and user interaction required. Evidence from multiple sources confi...

CVE-2024-46549

An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating devices owned by other users...

TP-LINK Kasa KP125M 安全漏洞

TP-LINK Kasa KP125M is a smart plug from China P&L TP-LINK. A security vulnerability exists in the TP-Link Kasa KP125M v1.0.3, which stems from an issue in the API gateway that can be exploited by an attacker to establish a connection by impersonating a device owned by another user...

CVE-2024-46549

An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating devices owned by other users...

CVE-2024-45229

The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors directly connected to the Internet, one of these APIs can ...