EUVD-2026-19517

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery SSRF protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be...

Unspecified Vulnerability in StudioCMS (CNVD-2026-18154)

StudioCMS is StudioCMS open source a content management system . A denial of service vulnerability exists in StudioCMS. The vulnerability stems from insufficient DELETE /studiocmsapi/dashboard/api-tokens endpoint validation, which can be exploited by an attacker to cause a denial of service...

Unspecified Vulnerability in StudioCMS (CNVD-2026-18153)

StudioCMS is StudioCMS open source a content management system . StudioCMS has an authorization issue vulnerability that originates from improper authorization of the /studiocmsapi/dashboard/api-tokens endpoint, which can be exploited by an attacker to cause elevation of privilege...

GHSA-WJ56-G96R-673Q StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

Summary The REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts...

CVE-2026-30945

CVE-2026-30945 : StudioCMS prior to 0.4.0 exposes an authorization flaw in DELETE /studiocms_api/dashboard/api-tokens. Any authenticated user with editor privileges or above can revoke API tokens for any user (including admin/owner) because tokenID and userID are taken directly from the request w...

CVE-2026-30233

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution exec may be...

CVE-2025-61728 vulnerabilities

Vulnerabilities for packages: helm-diff-fips, localstack, helm-operator, gitlab-rails-ce, cilium-envoy-fips, cilium-cli, external-dns-fips, gpu-operator-fips, mc, vitess, minio, runc, helm-set-status, thanos-operator-fips, headlamp, bom, kube-arangodb-fips, gitlab-rails-ce-fips, timoni, flux-fips...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: podinfo, tailscale, gptscript, mongodb-kubernetes-operator, kubernetes-dns-node-cache, kuma, newrelic-infrastructure-agent, nri-memcached, newrelic-nri-kube-events, sftpgo, nats-server, grafana-rollout-operator, gobuster, promxy, src-fingerprint, pdfcpu,...

EUVD-2018-6602

Malware in sbrugna...

EUVD-2018-6603

Malware in sbrugna...

EUVD-2022-27103

Malicious code in bioql PyPI...

GHSA-QXP5-GWG8-XV66 vulnerabilities

Vulnerabilities for packages: tailscale, gptscript, newrelic-infrastructure-agent, kubernetes-dns-node-cache, cert-exporter, newrelic-nri-kube-events, sftpgo, flyte, grafana-rollout-operator, crossplane-provider-azure-storage, promxy, src-fingerprint, opentofu, kyverno-notation-aws, kafkaexporter...

CVE-2024-45336 vulnerabilities

Vulnerabilities for packages: dagdotdev, kaniko, argo-events, rabbitmq-messaging-topology-operator, aws-flb-firehose, kiali-fips, cilium-envoy-fips, kubernetes-csi-external-provisioner-fips, age, splunk-otel-collector, gitea-fips, kube-logging-operator, podman, consul-k8s, kuberay-operator-fips,...

PT-2024-32715 · Unknown · Shilpi Client Dashboard

Name of the Vulnerable Software and Affected Versions: Shilpi Client Dashboard affected versions not specified Description: This issue is due to missing restrictions for incorrect login attempts on the API-based login of the Shilpi Client Dashboard. A remote attacker could exploit this by...

SUSE CVE-2022-21947

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API steve to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V...

CVE-2022-21947

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API steve to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V...

CVE-2022-21947

The CVE-2022-21947 entry concerns SUSE Rancher Desktop (Rancher Desktop) with an exposure of the Dashboard API (steve) to the local network. Affected: Rancher Desktop versions prior to V. Root cause: Exposure of Resource to Wrong Sphere vulnerability allows a local-network attacker to connect to ...

CVE-2022-21947 rancher desktop: Dashboard API is network accessible

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API steve to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V...

CVE-2022-21947 rancher desktop: Dashboard API is network accessible

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API steve to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V...

PT-2022-15197 · Suse · Suse Rancher Desktop

Name of the Vulnerable Software and Affected Versions: SUSE Rancher Desktop versions prior to V. Description: A vulnerability in SUSE Rancher Desktop allows attackers in the local network to connect to the "Dashboard API steve" to carry out arbitrary actions due to improper access control...