EUVD-2026-105172

ApostropheCMS: Missing Authentication in cleanExport Route...

GHSA-RW26-WWFC-9WVM ApostropheCMS: Missing Authentication in `cleanExport` Route

Summary The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

NPM: ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

NPM: ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API vulnerability discovered by ? in WordPress Npm apostrophe versions 4.34.0...

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

Summary ApostropheCMS lets a module expose an anonymous read API by setting publicApiProjection, which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of...

EUVD-2026-105104

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API...

GHSA-RQGM-CFRP-4HX8 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

Summary ApostropheCMS lets a module expose an anonymous read API by setting publicApiProjection, which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of...

ApostropheCMS: Import API bypasses publication roles for protected content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

GHSA-5M22-7PFQ-VP65 ApostropheCMS: Import API bypasses publication roles for protected content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

NPM: ApostropheCMS: Import API bypasses publication roles for protected content

NPM: ApostropheCMS: Import API bypasses publication roles for protected content vulnerability discovered by ? in WordPress Npm apostrophe versions 4.34.0...

EUVD-2026-107367

A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files API. The manipulation of the argument Request results in...

CVE-2026-114261

A vulnerability exists in the MomoTommy file-management-system within the Files API component. The issue affects the index/store/update/destroy functions in the file app/Http/Controllers/FileController.php. Due to missing authentication resulting from the manipulation of the Request argument, an ...

CVE-2014-3120

LAB 10-CVE-2014-3120 I. SYSTEM ANALYSIS Identifying the Attack Surface from the Docker Environment Starting with what is running in the environment. We list all active containers: docker ps Result: Container p1/lab10:latest is running, exposing 2 ports externally: Port mapping| Protocol ---|---...

SUSE CVE-2026-113062

Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

salt-scanner

salt-scanner A linux vulnerability scanner based on Vulners Audit API and Salt Open, with Slack notifications and JIRA integration. Features Slack notification and report upload JIRA integration OpsGenie integration Requirements Salt Open 2016.11.x salt-master, salt-minion¹ Python 2.7 salt you ma...

CVE-2026-114490

Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server...

CVE-2026-114477

Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over th...

CVE-2026-114489

Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A doma...

CVE-2026-114470

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

CVE-2026-114476

Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manageroles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin...

FOFA-API-Threaded-Searcher

FOFA API Threaded Searcher A powerful multi‑threaded Python tool to query the FOFA Fofa.so API, extract selected fields, and save unique results with intelligent formatting. ✨ Features Multi‑threaded – Fetch multiple pages concurrently configurable threads Custom fields – Choose any valid FOFA...