CVE-2026-14341 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper...

CVE-2026-67425 Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAIAPIKEY and ANTHROPICAPIKEY from the environment and sends them in the Authorization: Bearer header to caller-controlled baseurl, allowing an attacker to receive th...

CVE-2026-67425

CVE-2026-67425 affects Flyto2 Core. Prior to version 2.26.6, the component llm.chat reads provider keys (e.g., OPENAI_API_KEY, ANTHROPOLIC_API_KEY) from the environment and transmits them in an Authorization: Bearer header to a caller-controlled base_url, enabling an attacker to exfiltrate the op...

CVE-2026-49844

A flaw was found in Apache Log4j API. This vulnerability occurs due to improper encoding of non-finite floating-point values during JSON serialization of MapMessages, leading to invalid JSON output. An attacker who can supply a non-finite value can exploit this to cause the affected logging layou...

CVE-2026-8338

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoint...

GHSA-JQ8W-8Q2F-FFM9 ZITADEL Users Can Self-Verify Email/Phone via API

Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. While GHSA-282g-fhmx-xf54 CVE-2026-27946, "Users Can Self-Verify Email/Phone via UpdateHumanUser API" closed the path that...

CVE-2026-54693

CVE-2026-54693 affects Zitadel versions 2.43.0–2.71.19, 3.0.0–3.4.11, and 4.0.0–4.15.1. The vulnerability exists in the self-management API paths (internal/command/user_v2_email.go, internal/command/user_v2_phone.go, internal/command/user_v2_human.go), where verification codes could be requested ...

CVE-2026-54693 ZITADEL Users Can Self-Verify Email/Phone via API

ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/userv2email.go, internal/command/userv2phone.go, and internal/command/userv2human.go allowed...

CVE-2026-8338

The CVE describes a Spring Security authentication and authorization bypass in Coverity Connect versions 2023.6.0–2026.3.0. An unauthenticated attacker can send a specially crafted HTTP request to bypass authentication/authorization on certain API endpoints and access data within Coverity. CVSS 4...

CVE-2026-54663

creationtimestamp| type| source ---|---|--- 2026-07-29 16:35:19+00:00| published-proof-of-concept| https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-x36r-4347-pm5x...

CVE-2026-54664

creationtimestamp| type| source ---|---|--- 2026-07-29 16:35:14+00:00| published-proof-of-concept| https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-5f94-x226-ccpm 2026-07-29 18:08:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsjfnwzxr2q...

CVE-2026-8339

The CVE-2026-8339 issue affects Coverity Connect SOAP API, with SQL injection identified in versions 2024.6.0 through 2026.3.0 (inclusive). An authenticated attacker can send a crafted payload to achieve full read access to database contents and perform other unauthorized commands. The vulnerabil...

CVE-2026-60113

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...

WP2Shell WordPress Exploit Technical Analysis and Real Attack Data

On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a...

CVE-2026-60113 AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...

CVE-2026-60113 AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...

CVE-2026-54660

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...

CVE-2026-54663

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

CVE-2026-54661

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...

CVE-2026-54662

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...