PT-2026-1872

Name of the Vulnerable Software and Affected Versions GL.Inet GL.Inet AX1800 versions 4.6.4 and 4.6.8 Description An issue exists in the GL.iNet custom opkg wrapper script located at /usr/libexec/opkg-call within the GL.Inet AX1800. The script operates with root privileges when activated through...

CVE-2025-67091

The GL.Inet AX1800 (versions 4.6.4 and 4.6.8 ) is vulnerable to an issue in the custom opkg wrapper script located at /usr/libexec/opkg-call. The script is executed with root privileges when triggered via the LuCI web interface or authenticated API calls to manage packages. The root cause is the ...

PT-2025-50574

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 6.3 through 18.4.5 GitLab CE/EE versions 18.5 through 18.5.3 GitLab CE/EE versions 18.6 through 18.6.1 Description An authenticated user could potentially cause a Denial of Service condition by sending specially crafted A...

CVE-2025-61907: Exposure of Sensitive Information to an Unauthorized Actor

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information tha...

EUVD-2025-22988

Malicious code in bioql PyPI...

CVE-2024-58259

Technical details about CVE-2024-58259 are not provided in the connected documents. Initial description states a DoS due to unbounded request body processing in Rancher Manager, but no further specifics, versions, vectors or fixes are listed.

CVE-2025-41241

VMware vCenter contains a denial-of-service vulnerability. A malicious actor who is authenticated through vCenter and has permission to perform API calls for guest OS customisation may trigger this vulnerability to create a denial-of-service condition...

CVE-2025-41241

VMware vCenter contains a denial-of-service vulnerability. A malicious actor who is authenticated through vCenter and has permission to perform API calls for guest OS customisation may trigger this vulnerability to create a denial-of-service condition...

Improper Input Validation

@haxtheweb/haxcms-nodejs is vulnerable to improper input validation. The vulnerability is due to the application not properly handling exceptions when required URL parameters are missing in authenticated API requests, which allows an attacker to crash the application via the listFiles and saveFil...

CVE-2025-46122

An issue was discovered in CommScope Ruckus Unleashed software prior to versions 200.15.6.212.14 and 200.17.7.0.139 . The vulnerability exists in the authenticated diagnostics API endpoint /admin/_cmdstat.jsp, which fails to adequately validate attacker-controlled input before passing it to the s...

CVE-2025-4428

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests...

PT-2025-20319 · Maven · Org.Graylog2:Graylog2-Server

Impact Two minor vulnerabilities were identified in the Graylog2 enterprise server, which can be combined to carry out a stored cross-site scripting attack. An attacker with the permission FILES CREATE can exploit these vulnerabilities to upload arbitrary Javascript code to the Graylog2 server,...

CVE-2021-42718 Sensitive data unnecessarily returned from authenticated API

Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access to retrieve sensitive data, including application secrets, via accessing container definitions with environment variables through the Admin...

CVE-2021-42718

Replicated Classic versions prior to 2.53.1 are vulnerable to an Information Disclosure vulnerability in the Admin Console API on port 8800 . Authenticated users with Admin Console access can retrieve container definitions, which may expose sensitive data such as application secrets , passwords, ...

CVE-2024-36467

An authenticated user with API access e.g.: user with default User role, more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group e.g.: Zabbix Administrators, except to groups that are disabled or having restricted GUI access...

Computer Vision Annotation Tool security vulnerabilities

Computer Vision Annotation Tool CVAT is a cvat.ai open source interactive video and image annotation tool for computer vision. A security vulnerability exists in Computer Vision Annotation Tool CVAT versions 2.16.0 through 2.18.0, which stems from the fact that if an attacker can trick a logged-i...

CVE-2023-6792: Improper Neutralization of Argument Delimiters in a Command

An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall...

UBUNTU-CVE-2023-49080

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information...

Debian: Security Advisory (DLA-3562-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3562-1] orthanc security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3562-1 [email protected] https://www.debian.org/lts/security/ Anton Gladky September 12, 2023 https://wiki.debian.org/LTS -...