mitmproxy2swagger

mitmproxy2swagger https://user-images.githubusercontent.com/5400940/168086818-c48f60ab-3f95-42eb-b435-c8b1a6326b81.mp4 A tool for automatically converting mitmproxy captures to OpenAPI 3.0 specifications. This means that you can automatically reverse-engineer REST APIs by just running the apps an...

CyberPower - Missing Authentication

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. id: CVE-2024-32735 info: name: CyberPower - Missing Authentication author: DhiyaneshDK severity: critical description: | An issue regarding missing authentication for certai...

apicheck

APICheck - The DevSecOps toolset for REST APIs .. image:: https://img.shields.io/badge/License-Apache%202.0-blue.svg :target: https://github.com/BBVA/apicheck/blob/master/LICENSE :alt: License .. image:: https://readthedocs.org/projects/apicheck/badge/?version=latest :target:...

CVE-2026-78674

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the...

EUVD-2026-112402

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the...

CVE-2026-78674

Multiple WSO2 products are vulnerable to Remote Code Execution (RCE) due to insufficient input validation within the BPMN System REST APIs . An authenticated user can submit crafted requests to execute arbitrary commands on the server with the privileges of the product's runtime account. The pote...

CVE-2026-78674 Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the...

PT-2026-129165

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the...

WSO2 CVE-2026-5430 JWT alg:none admin bypass

CVE-2026-5430: forged alg:none JWT in X-JWT-Assertion grants access to WSO2 admin REST APIs applications, subscription keys. Confirmation / credential access — not arbitrary OS RCE. !/usr/bin/env python3 -- coding: utf-8 -- """WSO2 API Manager CVE-2026-5430 JWT alg:none admin API bypass.""" impor...

Incorrect Authorization

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

Arista VeloCloud Orchestrator Auth Bypass (CVE-2026-93952)

Targets CVE-2026-93952 in on-prem VeloCloud Orchestrator VCO: when certificate-based Edge authentication is enabled, forged/absent cert checks may allow unauthenticated access to privileged portal and REST APIs. Probes internal API routes after portal fingerprinting. !/usr/bin/env python3 --...

EUVD-2026-86476

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

CVE-2026-87720 Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

CVE-2026-87720

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

CVE-2026-87720

A vulnerability exists in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 due to Incorrect Authorization (CWE-863) . The flaw stems from project name normalization in ProjectUtil.stripGitSuffix and eviction logic in ProjectCacheImpl. Specificall...

CVE-2026-87720 Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

CVE-2026-87720: Incorrect Authorization

Incorrect Authorization CWE-863 in project name normalization ProjectUtil.stripGitSuffix and ProjectCache eviction logic ProjectCacheImpl in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user or an unauthenticated user ...

PT-2026-98310

Name of the Vulnerable Software and Affected Versions Gerrit Code Review versions 2.16.0 through 3.12.9 Gerrit Code Review versions 3.13.0 through 3.13.8 Gerrit Code Review versions 3.14.0 through 3.14.2 Description Incorrect authorization occurs during project name normalization in...

WordPress JWT Authentication for WP REST APIs plugin <= 4.7.0 - Unauthenticated Authentication Method Downgrade vulnerability

Unauthenticated Authentication Method Downgrade vulnerability discovered by Choriyev Qahramon in WordPress Plugin WordPress REST API Authentication versions = 4.7.0...

CVE-2026-76428

A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the session database. This vulnerability is due to certain parameters being concatenated directly into SQL clauses without parameterization. An...