CVE-2026-77767

Reconmap , a penetration-testing engagement management platform, has an unauthenticated information disclosure in its report preview endpoint. The PreviewReport action in ReportsController.cs is decorated with [AllowAnonymous], bypassing the API's fallback authorization policy that requires an au...

EUVD-2026-63901

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...

API-Security-Checklist

English | 繁中版 | 简中版 | العربية | Azərbaycan | Български | বাংলা | Català | Čeština | Ελληνικά | Español | فارسی | Français | हिंदी | Indonesia | Italiano | 日本語 | 한국어 | ພາສາລາວ | Македонски | മലയാളം | Монгол | Nederlands | Polski | Português Brasil | Русский | ไทย | Türkçe | Українська | Tiếng Việt...

Security Bulletin: Multiple vulnerabilities affect IBM License Metric Tool

Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication...

CVE-2026-66797

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

CVE-2026-62440

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

CVE-2026-50222

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachin...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to IBM SDK, Java Technology Edition Quarterly CPU - Oct 2025 (CVE-2025-53066, CVE-2025-53057)

Summary IBM SDK, Java Technology Edition Quarterly CPU - Oct 2025 is vulnerable to a Exposure of Sensitive Information, Improper Access Control attacks. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2025-53066 DESCRIPTION: An unspecified vulnerability in Java SE...

EUVD-2026-63846

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachin...

CVE-2026-62440 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

CVE-2026-62440

CVE-2026-62440 is an Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin . It allows cross-tenant manipulation of a Kubernetes cluster during node add/remove operations, meaning one tenant can affect another tenant's cluster. Affected versions are 4.21.0.0...

EUVD-2026-63835

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

CVE-2026-65613 Apache CloudStack: Webhook Deliveries Incorrect Access

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versio...

CVE-2026-65613

Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected by an access control flaw in the Webhook module . The issue allows an unauthorized actor to list and delete webhook deliveries , leading to exposure of sensitive information . The vulnerability require...

CVE-2026-66721

Apache CloudStack has a missing authorization flaw in its listHostTags API . Domain Admins can invoke this API by default, but the endpoint returns host tags for every host in the environment rather than being scoped to the admin's own domain. This exposes host tag information across domain bound...

CVE-2026-66797

Apache CloudStack versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected by an improper access control flaw in the annotation functionality. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified but fail to honor its result,...

CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

EUVD-2026-63831

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

CVE-2026-53791

A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources. Mitigation Restrict rsync daemon TCP/873 to the trusted proxy only CME-202...

CVE-2026-75796

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network,...