CVE-2026-19895: Improper Restriction of Excessive Authentication Attempts

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

CVE-2025-32781 Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId while...

Malicious Package

Overview app-config-utility is a malicious package. This package contains malicious code, and its content has been removed from the official package manager. While this package typosquats well-known libraries to impersonate valid open-source ecosystems, there is no connection between those...

CVE-2026-3643

The Accessibly WordPress plugin (versions ≤ 3.0.3) is vulnerable to an unauthenticated Stored XSS via REST API endpoints /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config. These endpoints have permission_callback set to __return_true, so no auth checks occur. updateWidgetOptions()...

CVE-2026-3643 Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API

The Accessibly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in all versions up to, and including, 3.0.3. The plugin registers REST API endpoints at /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config with the permissioncallback set to returntrue...

CVE-2025-60949: Exposure of Sensitive Information to an Unauthorized Actor

Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha...

Dinky 访问控制错误漏洞

Dinky is an open-source real-time computing platform developed by DataLinkDC. Versions of Dinky 1.2.5 and earlier contained a security vulnerability related to access control. This vulnerability stemmed from a missing authentication check in the addInterceptors function of the OpenAPI endpoint...

CVE-2025-68434: Cross-Site Request Forgery (CSRF)

Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery CSRF vulnerability exists in the application's filter configuration. The CSRF protection...

Malicious code in yandex-app-config (npm)

The package yandex-app-config was found to contain malicious code...

MAL-2025-40211 Malicious code in yandex-app-config (npm)

The package yandex-app-config was found to contain malicious code...

CVE-2024-47160

In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible...

PT-2024-32800 · Unknown · @Backstage/Plugin-App-Backend

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-app-backend versions prior to 0.3.75 Description: The issue concerns the configuration supplied through APP CONFIG environment variables, where the visibility defined in the configuration schema is unexpectedly ignored. This...

JetBrains YouTrack < 2024.3.44799 Multiple Vulnerabilities

The version of JetBrains YouTrack installed on the remote host is prior to 2024.3.44799. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached t...

CVE-2024-47160

In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible...

CVE-2024-47160

In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible...

CVE-2024-47160

JetBrains YouTrack before 2024.3.44799 is vulnerable to an issue where access to global application config data is possible without proper permissions. This CVE (CVE-2024-47160) is corroborated by multiple connected sources: Red Hat advisory, a Nessus plugin for JetBrains YouTrack

CVE-2024-47160

In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible...

PT-2024-6630

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.44799 Description: The issue is related to insufficient authorization mechanisms in JetBrains YouTrack, allowing access to global app config data without proper permissions. This could enable a remo...

CVE-2024-47160: Incorrect Authorization

In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible...

CVE-2023-38942: Improper Neutralization of Special Elements used in a Command

Dango-Translator v4.5.5 was discovered to contain a remote command execution RCE vulnerability via the component app/config/cloudconfig.json...