PT-2026-80640

Summary Glances provides as dict secure explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by ''". However, the implementation only checks KEY names against a...

CVE-2026-53959: Exposure of Sensitive Information to an Unauthorized Actor

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve arbitrary accounts through GET /api/users/:id. The users/index and users/show actions rely only...

CVE-2026-47720: Improper Neutralization of Special Elements used in an SQL Command

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a...

CVE-2026-71307: Missing Authorization

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required adminpermission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting...

PT-2026-80344

Cloudreve: Information Exposure in GET /api/v4/user/search: SearchActive omits the active-status predicate, leaking inactive/banned account emails in github.com/cloudreve/Cloudreve...

PT-2026-80234

Summary Lemur's destination read endpoints -- GET /api/1/destinations and GET /api/1/destinations/ -- return the full set of stored plugin option values to any authenticated user, with no authorization check and no redaction of secret-bearing options. The sibling write endpoints POST/PUT/DELETE a...

CVE-2026-64859

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

CVE-2026-64859: Exposure of Sensitive Information to an Unauthorized Actor

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

CVE-2026-71424: Exposure of Sensitive Information to an Unauthorized Actor

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

CVE-2026-68520: Exposure of Sensitive Information to an Unauthorized Actor

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

CVE-2026-11817: Incorrect Authorization

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

CVE-2026-73304: Exposure of Sensitive Information to an Unauthorized Actor

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve...

CVE-2026-73604: Exposure of Sensitive Information to an Unauthorized Actor

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...

CVE-2026-73488: Authorization Bypass Through User-Controlled Key

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...

PT-2026-102297

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserialize value without the check forbidden xcom keys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow...

CVE-2026-73301: Missing Authorization

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder...

CVE-2026-47717: Insertion of Sensitive Information Into Sent Data

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue...

CVE-2026-73406: Exposure of Sensitive Information to an Unauthorized Actor

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLICENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...

PT-2026-105506

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserialize value without the check forbidden xcom keys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow...

PT-2026-68783

Name of the Vulnerable Software and Affected Versions Dinky version 1.2.5 Description The getAll function in the SysConfigController contains a method-level @SaIgnore annotation that bypasses the class-level @SaCheckLogin security check. This allows unauthenticated remote callers to access the GE...