cenzopapa-sdk (>=1.0.3, <=1.1.1), fastapi-builder (>=1.0.1, <=1.2.0) +6 more potentially affected by CVE-2026-63374 via anyio (3.4.0)

anyio PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - cenzopapa-sdk =1.0.3, =1.0.1, =0.0.1, =0.16.0, =0.0.1, =0.0.8, =0.0.1, =0.0.8 Source cves: CVE-2026-63374 Source advisory: OSV:PYSEC-2026-4025...

cenzopapa-sdk (>=1.0.3, <=1.1.1), fastapi-builder (>=1.0.1, <=1.2.0) +6 more potentially affected by CVE-2026-64847 via anyio (3.4.0)

anyio PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - cenzopapa-sdk =1.0.3, =1.0.1, =0.0.1, =0.16.0, =0.0.1, =0.0.8, =0.0.1, =0.0.8 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

cenzopapa-sdk (>=1.0.3, <=1.1.1), fastapi-builder (>=1.0.1, <=1.2.0) +6 more potentially affected by CVE-2026-64847 via anyio (3.4.0)

anyio PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - cenzopapa-sdk =1.0.3, =1.0.1, =0.0.1, =0.16.0, =0.0.1, =0.0.8, =0.0.1, =0.0.8 Source cves: CVE-2026-64847 Source advisory: OSV:GHSA-5P39-CFHJ-2XMP...

Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...

CVE-2026-54569: Improper Neutralization of Directives in Dynamically Evaluated Code

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

EUVD-2026-40139

Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across...

Drupal Core 10.5.5 - Error-Based SQL Injection

Exploit Title: Drupal Core 10.5.5 - Error-Based SQL Injection Google Dork: N/A Date: 2026-05-31 Exploit Author: cardosource Vendor Homepage: https://www.drupal.org Software Link: https://www.drupal.org/project/drupal Version: Drupal Core 10.5.5 Tested on: Debian Linux Docker, PHP 8.2, Apache,...

Graphiti 安全漏洞

Graphiti is a framework developed by Zep for building temporal context graphs for AI agents. Versions of Graphiti prior to 1.10.2 contained security vulnerabilities. These vulnerabilities stemmed from the JSONAPI writing feature not verifying the relationship names provided by users, which could...

CVE-2026-33286: Improper Control of Dynamically-Managed Code Resources

Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary...

CVE-2026-33286

CVE-2026-33286 (Graphiti) affects Graphiti prior to 1.10.2. The vulnerability arises because Graphiti::Util::ValidationResponse#all_valid? calls model.send(name) using relationship names directly from user-supplied JSONAPI payloads during write operations (create/update/delete) without validating...

CVE-2026-33286

Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary...

GHSA-3M5V-4XP5-GJG2 Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names

Summary An arbitrary method execution vulnerability has been found which affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations...

CVE-2021-47763

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint...

CVE-2021-47763

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint...

CVE-2021-47763 Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint...

EUVD-2026-2770

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint...

Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint...

PT-2026-6436

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint...

CVE-2021-47763: Improper Neutralization of Special Elements used in an SQL Command

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint...

CVE-2025-14184

A vulnerability was determined in SGAI Space1 NAS N1211DS up to 1.0.915. Impacted is the function RENAMEFILE/OPERATEFILE/NGNIXUPLOAD of the file /cgi-bin/JSONAPI of the component gsaiagent. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been...