CVE-2026-112954

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the...

CVE-2026-112948

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

CVE-2026-111765

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

Inspeckage

Inspeckage - Android Package Inspector Inspeckage is a tool developed to offer dynamic analysis of Android applications. By applying hooks to functions of the Android API, Inspeckage will help you understand what an Android application is doing at runtime. http://ac-pm.github.io/Inspeckage...

h8mail

h8mail is an email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's "Collection1" and the infamous "Breach Compilation" torrent. 📖 Table of Content Table of Content Features APIs Usage Usage examples Thanks & Credits Related...

CVE-2026-113648

The ApostropheCMS Node.js content management system contains a vulnerability in the @apostrophecms/import-export module prior to version 3.7.1 . The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export lacks necessary authentication and authorization checks. This allows any client,...

CVE-2026-113648 ApostropheCMS: Missing Authentication in `cleanExport` Route

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

cve-2026-9082

CVE-2026-9082 Type : SQL Injection CWE-89 Affected Product : Drupal Core Database Abstraction API Drupal Advisory : SA-CORE-2026-004 Published : May 20, 2026 Severity : Highly Critical Drupal 20/25 | NVD CVSS 6.5 What Is It? CVE-2026-9082 is a SQL Injection vulnerability in Drupal's core database...

CVE-2026-112954

The ApostropheCMS Node.js content management system (versions prior to 4.34.0 ) contains a vulnerability in the public REST API. A public REST API type utilizing publicApiProjection can be exploited via search membership and sort ordering oracles to bypass projection restrictions. This allows an ...

cli

CloudGraph is the free open-source universal GraphQL API and Cloud Security Posture Management CSPM tool for AWS, Azure, GCP, and K8s. With CloudGraph you get: Free and effortless compliance checks i.e. Azure CIS 1.3.1, GCP CIS 1.2, AWS CIS 1.2, AWS CIS 1.3, AWS CIS 1.4, AWS PCI 3.2.1, AWS NIST...

CVE-2026-113677

Froxlor versions 0.10.0 before 2.3.15 are vulnerable to a missing authorization flaw in the SubDomains.delete API command. This allows authenticated customers to delete reseller-provisioned main domains by providing a specific main domain ID, bypassing web UI restrictions. Successful exploitation...

CVE-2026-113612 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

EUVD-2026-105090

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113612

The SparkyFitness application (versions prior to 0.17.0 ) contains a missing authorization vulnerability (CWE-862) within the DELETE /api/foods/food-variants/:id endpoint. This flaw allows authenticated users to delete serving and nutrition variants belonging to other users. Attackers can identif...

EUVD-2026-105084

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/...

CVE-2026-113606

Stirling-PDF versions 3.0.0 through 3.2.0 are vulnerable to an authorization bypass (CWE-639) within the processing folders functionality. Authenticated users can access files belonging to other users by pointing a processing folder at the server storage directory via a POST /api/v1/processing-fo...

EUVD-2026-105165

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject...

CVE-2026-113599

Modoboa versions before 2.8.0 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the API v2 armessages endpoint. This vulnerability allows authenticated users to create auto-reply messages for arbitrary mailboxes by providing another user's mbox value . An attacker can perform a...

CVE-2026-113599 Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject...

CVE-2026-113599 Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject...