PT-2026-89576

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

PT-2026-89258

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters interval, format, emailTo in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-88897: Use of GET Request Method With Sensitive Query Strings

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access...

CVE-2026-87870: Improper Neutralization of Input During Web Page Generation

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters interval, format, emailTo in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-89054: Missing Authorization

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89089: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization via the api middleware group in the authentication process. An attacker can maintain unauthorized access to the REST API with previously issued persona...

CVE-2026-86750

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...

EUVD-2026-74939

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86750

Snipe-IT versions ≤ 8.6.3 (fixed in 8.7.0 ) contain an authorization bypass in the REST API's Api\UsersController::store() and ::update() methods. User records are persisted before the requested company identifiers are validated against the actor's permitted companies via Company::getIdsForCurren...

CVE-2026-86750 snipe-it before 8.7.0 Authorization Bypass via API User Create/Update

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...

CVE-2026-86750 snipe-it before 8.7.0 Authorization Bypass via API User Create/Update

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...

CVE-2026-86750 snipe-it before 8.7.0 Authorization Bypass via API User Create/Update

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...

EUVD-2026-74927

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...

CVE-2026-41870

Missing Authorization, Improper Control of Generation of Code 'Code Injection', Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache...

CVE-2026-41869

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, use...

CVE-2026-41871

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. I...

CVE-2026-41871 Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. I...

CVE-2026-41871

Apache Nutch versions 1.10 through 1.22 are vulnerable to a Missing Authorization and Unsafe Reflection vulnerability within the Nutch Server (Nutch REST API) . The root cause involves the use of externally-controlled input to select classes or code, which can lead to unauthenticated reflection-b...

EUVD-2026-74803

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. I...