Lucene search
+L

60122 matches found

Cvelist
Cvelist
added 2026/06/24 6:5 p.m.37 views

CVE-2026-53949 Ghost Content API filter bypass reveals private fields

Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully...

5.3CVSS0.00214EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/24 6:5 p.m.65 views

CVE-2026-53949

Summary (CVE-2026-53949) Ghost CMS (Node.js). Affected versions: 5.46.1–6.21.2. Description: validation on filters for public API endpoints could be partially bypassed, enabling disclosure of private fields via brute-force. Impact depends on database: with SQLite, password hashes were fully acces...

5.3CVSS5.8AI score0.00214EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/06/24 3:37 p.m.10 views

CVE-2026-13164

Missing Authentication for Critical Function CWE-306 in the RegisterView apps/accounts/views.py, exposed at POST /api/auth/register/, in MailerUp 1.0.1 allows a remote, unauthenticated attacker to self-register a working account on instances where registration is intended to be restricted, becaus...

8.8CVSS6AI score0.00406EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/06/24 2:1 p.m.43 views

CVE-2026-11877 Missing Authorization Vulnerability in OpenText Access Manager

An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3...

6.3CVSS0.00178EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/24 2:1 p.m.46 views

CVE-2026-11877

CVE-2026-11877 affects OpenText Access Manager prior to 5.1.3. An unauthorised user can modify configuration via API calls, indicating a missing authorization vulnerability. Supported details show the impact is at the configuration level (no data leakage described) with remote network access requ...

7.5CVSS5.9AI score0.00178EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/06/24 1:20 p.m.23 views

CVE-2026-57297

CVE-2026-57297 affects Jenkins via the Contrast Continuous Application Security Plugin (3.11 and earlier). The issue is a missing permission check that lets attackers with Overall/Read access cause a connection to an attacker‑specified URL using attacker‑provided credentials (username, API key, s...

5.4CVSS5.8AI score0.00167EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/06/24 1:16 p.m.15 views

CVE-2025-71332

Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to ...

8.8CVSS0.00345EPSS
SaveExploits1References2
OSV
OSV
added 2026/06/24 11:53 a.m.7 views

CVE-2026-56310 Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass

Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that allows org-limited API keys to bypass limitedtoorgs restrictions. Attackers with org-limited API keys can read membership data including uid, email, imageurl, role, and istmp from...

5.3CVSS6AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/06/24 11:53 a.m.39 views

CVE-2026-56262 Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructive operations. Remote attackers can invoke the /monitor/actions/cleanup endpoint and manipulate monitoring state without authentication,...

6.9CVSS0.00417EPSS
SaveExploits0References3
CVE
CVE
added 2026/06/24 11:53 a.m.21 views

CVE-2026-56256

CVE-2026-56256 affects Capgo prior to 12.128.2, where 2FA is enforced only at the UI level. The backend ORG management API endpoints (e.g., editing organization details, inviting users) do not require 2FA, allowing an authenticated admin without 2FA to replay/modify a captured ORG API request to ...

7.1CVSS5.9AI score0.00238EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/06/24 11:53 a.m.38 views

CVE-2026-56256 Capgo - Two-Factor Authentication Bypass via Organization Management API

Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization ORG management API endpoints e.g., editing organization details, inviting users do not validate 2FA completion on the backend. An authenticated Admin user who has not enabled 2FA can...

7.1CVSS0.00238EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/06/24 11:53 a.m.40 views

CVE-2026-56237 Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation

Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user. An attacker can tamper with the API key...

9.3CVSS0.00293EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/24 11:53 a.m.13 views

EUVD-2026-38740

Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user. An attacker can tamper with the API key...

9.3CVSS6AI score0.00293EPSS
SaveExploits0References2
CVE
CVE
added 2026/06/24 11:53 a.m.17 views

CVE-2026-56231

Capgo prior to 12.128.2 contains a broken object level authorization (BOLA) in build endpoints: POST /build/start/:jobId and POST /build/cancel/:jobId. The handlers validate only the attacker-controlled app_id in the request body and fail to verify that the URL jobId belongs to the same app/tenan...

7.6CVSS6.1AI score0.00176EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/24 11:53 a.m.18 views

EUVD-2026-38738

Capgo before 12.128.2 contains a broken object level authorization BOLA vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled appid supplied in the request body and never verify that the jobI...

7.6CVSS6.1AI score0.00176EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/24 9:3 a.m.9 views

SUSE-SU-2026:2617-1 Security update for bind

This update for bind fixes the following issues: - CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records bsc1265592. - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation bsc1265591. - CVE-2026-5946: Invalid handling of CLASS != IN bsc1265594...

7.5CVSS5.8AI score0.01874EPSS
SaveExploits0References7
SUSE Linux
SUSE Linux
added 2026/06/24 9:3 a.m.6 views

Security update for bind

This update for bind fixes the following issues: CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records bsc1265592. CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation bsc1265591. CVE-2026-5946: Invalid handling of CLASS != IN bsc1265594. Patch...

7.5CVSS5.8AI score0.01874EPSS
SaveExploits0References12
NVD
NVD
added 2026/06/24 7:16 a.m.18 views

CVE-2026-9709

The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co...

7.7CVSS0.00212EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/24 7:16 a.m.20 views

CVE-2026-9183

The 24liveblog - live blog tool plugin for WordPress is vulnerable to Exposure of Sensitive Information in versions up to, and including, 2.2. This is due to the lb24blockenqueuescripts function being hooked to enqueueblockeditorassets and, for any non-administrator user, falling back to loading...

4.3CVSS0.00204EPSS
SaveExploits0References3
NVD
NVD
added 2026/06/24 7:16 a.m.16 views

CVE-2026-12095

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'apiurl' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be...

7.2CVSS0.0029EPSS
SaveExploits0References4
Rows per page
Query Builder