CVE-2026-104893 Plane: Improper validation allows arbitrary modification of API token rate limits

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-104893

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-104893

The project management tool Plane is vulnerable to improper validation in its API. Prior to version 1.4.0 , an authenticated user can use the PATCH /api/users/api-tokens/{token_id}/ endpoint to modify the allowed_rate_limit field without server-side validation or a maximum limit. This allows an a...

SUSE CVE-2026-71886

In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify...

SUSE CVE-2026-71887

In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...

CVE-2026-104892 Plane: Plaintext logging of API token

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0...

CVE-2026-88394

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...

USN-8870-1 aodh, watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

USN-8870-1: OpenStack Aodh and Watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

Kemp LoadMaster Command Injection (CVE-2024-1212)

Exploits CVE-2024-1212 in Progress Kemp LoadMaster: unauthenticated command injection via /access/set?param=enableapi&value=... management API. !/usr/bin/env python3 -- coding: utf-8 -- """Progress Kemp LoadMaster unauth command injection CVE-2024-1212.""" import re import urllib.parse from...

GitLab Commits API file.path LFI (CVE-2026-85706)

Exploits CVE-2026-85706 in self-managed GitLab CE/EE: unauthenticated multipart POST to /api/v4/projects/id/repository/commits with attacker-controlled file.path reads arbitrary host files outside Workhorse temp directories. !/usr/bin/env python3 -- coding: utf-8 -- """GitLab unauthenticated...

Ivanti EPMM Authentication Bypass (CVE-2023-35078)

Exploits CVE-2023-35078 in Ivanti Endpoint Manager Mobile EPMM: unauthenticated access to /mifs/aad/api/v2/admins/users allows reading admin accounts and creating a new local administrator. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPMM unauthenticated admin API access CVE-2023-35078.""...

Ivanti EPMM Authentication Bypass (CVE-2023-35082)

Exploits CVE-2023-35082 in Ivanti EPMM MobileIron Core 11.2 and older: unauthenticated access to /mifs/asfV3/api/v2/admins/users allows admin enumeration and account creation. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPMM/MobileIron unauthenticated API access CVE-2023-35082.""" import...

Xiaomi Mi WiFi R3G LFI (CVE-2019-18371)

Exploits CVE-2019-18371 in Xiaomi Mi WiFi R3G 2.28.23: NGINX alias misconfiguration allows reading /etc/config/account and other files via api-third-party/download. !/usr/bin/env python3 -- coding: utf-8 -- """Xiaomi Mi WiFi R3G NGINX alias LFI CVE-2019-18371.""" import re from kittysploit import...

Ivanti Connect Secure Command Injection (CVE-2024-21887)

Chains CVE-2023-46805 path traversal auth bypass with CVE-2024-21887 command injection via /api/v1/totp/user-backup-code/../../admin/config/set on Ivanti Connect Secure / Policy Secure gateways. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Connect Secure auth bypass + command injection...

Langflow Broken Access Control (CVE-2026-21445)

Exploits CVE-2026-21445 in Langflow 1.7.0.dev45: unauthenticated access to /api/v1/monitor/messages and related monitor endpoints exposes user conversation data and allows destructive operations without authorization. !/usr/bin/env python3 -- coding: utf-8 -- """Langflow broken access control on...

ASUS GT-AC2900 Auth Bypass (CVE-2021-32030)

Exploits CVE-2021-32030 in ASUS GT-AC2900: asustoken null-byte cookie with asusrouter User-Agent grants unauthenticated admin API access. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS GT-AC2900 null-byte auth bypass CVE-2021-32030.""" import json from kittysploit import from...

GL.iNET Wi-Fi Key Disclosure (CVE-2023-31478)

Exploits CVE-2023-31478 in GL.iNet routers 3.216: unauthenticated POST to /api/router/mesh/status leaks SSID and Wi-Fi encryption key. !/usr/bin/env python3 -- coding: utf-8 -- """GL.iNET mesh status Wi-Fi key disclosure CVE-2023-31478.""" from kittysploit import from lib.protocols.http.httpclien...

Ivanti Endpoint Manager Auth Bypass (CVE-2026-1603)

Exploits CVE-2026-1603 in Ivanti Endpoint Manager 2024 SU5: unauthenticated POST to /RemoteControlAuth/api/Auth with logintype 64 leaks session identifiers and stored credential metadata. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Endpoint Manager auth bypass CVE-2026-1603.""" import jso...

Cisco SD-WAN Manager Auth Bypass (CVE-2026-76504)

Exploits CVE-2026-76504 in Cisco Catalyst SD-WAN Manager: POST to a percent-encoded /jsecuritycheck path bypasses WildFly authentication constraints and yields an admin-level JSESSIONID, enabling full vManage API access and device template deployment. !/usr/bin/env python3 -- coding: utf-8 --...