CVE-2026-27177

MajorDoMo exposes a stored XSS via the /objects/?op=set endpoint, usable without authentication for IoT integration. User-supplied property values are stored raw and rendered unescaped in the admin property editor (SOURCE as a paragraph and VALUE in a textarea) on page load. The vulnerability als...

Rembg allows SSRF via /api/remove

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg...

ROS-20241211-09

A vulnerability in the Expressions feature of the Grafana monitoring and surveillance platform is related to improper code generation control. Exploitation of the vulnerability could allow a remote attacker, execute arbitrary code by injecting specially crafted SQL queries A vulnerability in the...

CVE-2021-41130

Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API services. ESPv1 can be configured to authenticate a JWT token. Its verified JWT claim is passed to the application by HTTP header "X-Endpoint-API-UserInfo", the application can use ...

CVE-2021-1532

A vulnerability in the video endpoint API xAPI of Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. This vulnerability is due to insufficient path validation o...

Cisco TelePresence Collaboration Endpoint Software Information Disclosure (cisco-sa-tele-info-DrEGLpDQ)

According to its self-reported version, Cisco TelePresence Collaboration Endpoint Software is affected by a vulnerability in the video endpoint API xAPI. An authenticated, remote attacker can exploit this, by accessing information that should not be accessible to users with low privileges, in ord...

DRIVE.NET, Inc.: [www.drive2.ru] There is no rate limit for comments endpoints.

The "add comment" endpoint was improperly rate-limited so the potential attacker could post a large number of comments, overloading the server and the notification system. Summary The add comment endpoint was improperly rate-limited so the potential attacker could post a large number of comments,...