EUVD-2026-48493

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts...

OESA-2026-3153 log4j security update

Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fixes: Apache Log4j's JsonTemplateLayout in versions up to and including 2.25.3 produces invalid JSON output when log events contain non-finite floating-point values NaN, Infinity, or -Infinity,...

OESA-2026-3116 pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fixes: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return.CVE-2026-14324...

SUSE CVE-2026-15789

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

SUSE CVE-2026-15793

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

CVE-2026-35425

Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...

EUVD-2026-48445

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...

EUVD-2026-48455

Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...

CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability

...

CVE-2026-35425

CVE-2026-35425 concerns Azure API Management (APIM) with an “Improper access control” condition that enables a network-exposed remote code execution by an authorized attacker. Affected software is APIM; the root cause is access-control weaknesses that allow code execution over the network. The pr...

CVE-2026-35425

Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...

CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability

...

PT-2026-64201

Name of the Vulnerable Software and Affected Versions Azure API Management affected versions not specified Description Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network. Recommendations At the moment, there is no information about a...

PT-2026-64318

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

PT-2026-64307

Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.3 Description The automation jobs API contains a flaw where sensitive information is included in sent data. An authenticated user with scoped job or script read permissions can obtain...

CVE-2026-40430

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...

CVE-2026-40430 Plaintext Storage of a Password in Panduit IntraVUE by Pronetiqs

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...

CVE-2026-47723

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

CVE-2026-47724 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2026-47724 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...