CVE-2026-113598

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulkdelete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms...

CVE-2026-112954

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the...

CVE-2026-112948

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

CVE-2026-111765

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

CVE-2026-113648 ApostropheCMS: Missing Authentication in `cleanExport` Route

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

CVE-2026-113648

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

CVE-2026-113648

The ApostropheCMS Node.js content management system contains a vulnerability in the @apostrophecms/import-export module prior to version 3.7.1 . The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export lacks necessary authentication and authorization checks. This allows any client,...

CVE-2026-113648 ApostropheCMS: Missing Authentication in `cleanExport` Route

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

CVE-2026-113648 ApostropheCMS: Missing Authentication in `cleanExport` Route

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

WSO2 API Manager side-channel information disclosure vulnerability

WSO2 API Manager versions prior to 3.1.0 through 3.1.0.310, 3.2.0 through 3.2.0.401, 3.2.1 through 3.2.1.26, 4.0.0 through 4.0.0.318, 4.1.0 through 4.1.0.180, 4.2.0 through 4.2.0.119, and 4.3.0 through 4.3.0.30; WSO2 Identity Server as Key Manager versions prior to 5.10.0 through 5.10.0.320; WSO2...

Apache Traffic Server resource management error vulnerability

Versions 10.0.0 through 10.1.4 and 10.2.0 of Apache Traffic Server contain a resource management error vulnerability. This vulnerability stems from post-free reuse in the transaction close handler within an experimental WASM plugin, which forwards unvalidated metric IDs provided by guests to an...

Storybook path traversal vulnerability

A security vulnerability exists in Storybook versions prior to 8.0.0 through 8.6.19, 9.0.0 through 9.1.21, 10.0.0 through 10.6.2, and 11.0.0-alpha.0 through 11.0.0-alpha.6. This vulnerability arises because the development server exposes WebSocket authentication tokens to clients capable of loadi...

Chris Trudesk authorization issue vulnerability

Versions 1.2.11 and earlier of Chris Trudesk contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in apiMessages.send; attackers can supply arbitrary owner and cId parameters to POST /api/v1/messages/send, thereby posting forged messages as other use...

ekko-studio input validation error vulnerability

Versions 1.0.6 and earlier of ekko-studio contain an input validation error vulnerability. This vulnerability stems from improper handling of the outputpath parameter in the saveGeneratedImages function within the Media Generation API component, specifically in the file...

Apache Pulsar authorization issue vulnerability

Versions 2.8.0 through 4.0.14 and 4.1.0 through 4.2.5 of Apache Pulsar contain an authorization issue vulnerability. This vulnerability arises because multiple operations within the subscription management REST API fail to apply prefix-based subscription authentication or subscription permission...

Splunk SOAR side-channel information disclosure vulnerability

Versions of Splunk SOAR prior to 8.7.0 contain a side-channel information disclosure vulnerability. This vulnerability arises when Basic authentication values are decrypted prior to completing authentication checks. Unauthenticated users can submit these Basic authentication data to the REST API,...

hMailServer cross-site request forgery vulnerability

Versions 6.0.0 through 6.3.6 of hMailServer contain a cross-site request forgery vulnerability. This flaw arises because the REST API’s cross-site request forgery protection only applies to cookie sessions and does not cover HTTP Basic authentication. As a result, remote attackers may exploit the...

OpenStack Cinder permission and access control issues

OpenStack Cinder versions 29.0.0 and earlier have vulnerabilities related to permission permissions and access control. These vulnerabilities stem from information leakage across projects due to the Messages API. When non-administrator users with project-wide member or reader roles call the Block...

Splunk SOAR information disclosure vulnerability

Versions of Splunk SOAR prior to 8.7.0 contain an information disclosure vulnerability. This vulnerability arises because the REST API query filter applies to user records prior to protecting sensitive fields. Users with the Observer role can exploit this filter to infer other users’ password...

Splunk SOAR authorization issue vulnerability

Versions of Splunk SOAR prior to 8.7.0 contain an authorization issue vulnerability. This vulnerability arises because Splunk SOAR validates requests via the REST API only and does not authenticate the caller. As a result, authenticated users may modify Enterprise Security versions and apply...