23 matches found
CVE-2026-116108
A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbbplatform/core/openbbcore/app/model/apisettings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The...
CVE-2026-116108 openbq-org OpenBB Local API Server api_settings.py access control
A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbbplatform/core/openbbcore/app/model/apisettings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The...
EUVD-2026-109600
A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbbplatform/core/openbbcore/app/model/apisettings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The...
CVE-2026-116108 openbq-org OpenBB Local API Server api_settings.py access control
A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbbplatform/core/openbbcore/app/model/apisettings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The...
CVE-2026-116108
A flaw in openbq-org OpenBB (versions up to 4.7.2/5.0.0 ) affects the Local API Server component. The vulnerability exists within the file openbb_platform/core/openbb_core/app/model/api_settings.py, where a flaw leads to improper access controls . This issue allows for remote exploitation , and t...
CVE-2026-116108
A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbbplatform/core/openbbcore/app/model/apisettings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The...
OpenBB permission and access control issue vulnerability
OpenBB versions 4.7.2 and earlier, as well as 5.0.0 and earlier, contain a permission and access control vulnerability. This vulnerability stems from improper access control in the file openbbplatform/core/openbbcore/app/model/apisettings.py within the Local API Server component, potentially...
PT-2026-123154
A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb platform/core/openbb core/app/model/api settings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. Th...
CVE-2026-66005
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...
EUVD-2026-48611
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...
CVE-2026-66005 Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...
CVE-2026-66005 Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...
CVE-2026-66005
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...
CVE-2026-66005
CVE-2026-66005 affects Jan up to version 0.8.4. The local API server has a CORS misconfiguration that replaces user-configured trusted hosts with a wildcard, reflecting arbitrary origins with credentials. This enables network-adjacent attackers to bypass trusted host restrictions and reach the un...
CVE-2026-66005
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...
CVE-2026-66005 Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...
CVE-2026-66005: Permissive List of Allowed Inputs
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...
PT-2026-64318
Name of the Vulnerable Software and Affected Versions Jan versions prior to 0.8.4 Description A CORS Cross-Origin Resource Sharing misconfiguration in the local API server allows network-adjacent attackers to bypass trusted host restrictions. This occurs because the server replaces user-configure...
CVE-2026-58169 Vibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code Execution
Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopback clients combined with missing Host header validation while binding to...