PT-2026-25880

Summary The User management API endpoints GET /api/v1/users and GET /api/v1/users/id are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status. Affected Endpoints 1. GET /api/v1/users UserController::index, line ...

CVE-2026-28352

CVE-2026-28352 affects Indico (event management system) prior to 3.3.11. The vulnerability is an missing access check in the API endpoint that manages event series, enabling unauthenticated/unauthorized access to metadata (title, category chain, start/end date) for events in an existing series, a...

Caddy Cross-Site Request Forgery Vulnerability

Caddy is an open-source, cross-platform HTTP/Web server developed by the Caddy company. Versions of Caddy prior to 2.11.1 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the local Caddy management API accepting cross-domain requests when source forcing was n...

CVE-2026-23596

A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability...

CVE-2026-23596

A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability...

CVE-2026-23596: Uncontrolled Resource Consumption

A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability...

HPE Aruba Networking Private 5G Core security vulnerabilities

HPE Aruba Networking Private 5G Core is a 5G core component developed by the American company HPE. There is a security vulnerability present in HPE Aruba Networking Private 5G Core, which stems from a flaw in the management API. This vulnerability could allow unverified remote attackers to trigge...

CVE-2025-65128

A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers on the local network to modify router and network configurations. By invoking operations whose names end with "nocommit" and supplying the...

PT-2026-7623

Name of the Vulnerable Software and Affected Versions Shenzhen Zhibotong Electronics ZBT WE2001 version 23.09.27 Description A flaw exists in the web management API components that allows unauthenticated attackers on the local network to modify router and network configurations. Attackers can...

CVE-2025-65128: Improper Authentication

A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers on the local network to modify router and network configurations. By invoking operations whose names end with "nocommit" and supplying the...

CVE-2025-65128

A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers on the local network to modify router and network configurations. By invoking operations whose names end with "nocommit" and supplying the...

PT-2026-21006

Multiple security vulnerabilities affect the management-api-for-apache-cassandra-5.0 package. These issues are resolved in later releases. See references for individual vulnerability details...

Tildeslash M/Monit Security Vulnerability

Tildeslash M/Monit is a server monitoring and management tool developed by Tildeslash Inc. Version 3.7.4 of Tildeslash M/Monit contains a security vulnerability. This vulnerability stems from an authentication flaw in the management API endpoints, which could lead to the retrieval of user passwor...

GHSA-QQPG-MVQG-649V vulnerabilities

Vulnerabilities for packages: cassandra-reaper, apache-nifi-registry, kserve-modelmesh, apache-nifi, management-api-for-apache-cassandra-5.0, trino, nextflow, zookeeper, keycloak-config-cli, akhq, sonarqube, dependency-track, sonar-scanner-cli, cassandra...

CVE-2026-1225 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, apache-nifi-registry, kserve-modelmesh, apache-nifi, management-api-for-apache-cassandra-5.0, trino, nextflow, zookeeper, keycloak-config-cli, akhq, sonarqube, dependency-track, sonar-scanner-cli, cassandra...

GHSA-QQPG-MVQG-649V vulnerabilities

Vulnerabilities for packages: hadoop-fips, ontop-fips, knative-kafka-broker-fips, nacos-docker, ontop, sonar-scanner-cli, nextflow, keycloak-config-cli, cassandra, ranger, cassandra-reaper, cassandra-fips, dependency-track-apiserver, kafbat-ui, sonarqube, apache-nifi, nacos,...

CVE-2026-1225 vulnerabilities

Vulnerabilities for packages: hadoop-fips, ontop-fips, knative-kafka-broker-fips, nacos-docker, ontop, sonar-scanner-cli, nextflow, keycloak-config-cli, cassandra, ranger, cassandra-reaper, cassandra-fips, dependency-track-apiserver, kafbat-ui, sonarqube, apache-nifi, nacos,...

CVE-2026-24428: Incorrect Authorization

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an...

📄 ZITADEL 4.7.0 Server-Side Request Forgery

This is a ZITADEL version 4.7.0 server-side request forgery proof of concept exploit written in PHP. ============================================================================================================================================= | Title : ZITADEL 4.7.0 SSRF Exploit - PHP Version | |...

Bluspark BLUVOYIX security vulnerabilities

Bluspark BLUVOYIX is a digital supply chain management platform from US-based Bluspark, Inc. Bluspark BLUVOYIX suffers from a security vulnerability that stems from improper authentication of the management API, which could lead an attacker to create new users with administrator privileges, which...