PT-2026-96132

Name of the Vulnerable Software and Affected Versions GoCD versions 12.3.1 through 26.0.x Description Legacy routes under the endpoint '/go/admin/restful/' expose the full historical server configuration to pipeline group administrators. This occurs because the system fails to restrict responses ...

Astra Linux - Vulnerability in golang-github-emicklei-go-restful

Authorization bypass through user-controlled keys in the GitHub repository in the emicklei/go-restful library, prior to version 3.8.0...

[SECURITY] Fedora 45 Update: rest-0.10.2-12.fc45

This library was designed to make it easier to access web services that claim to be "RESTful". A RESTful service should have urls that represent remote objects, which methods can then be called on. The majority of services don't actually adhere to this strict definition. Instead, their RESTful en...

[SECURITY] Fedora 43 Update: rest-0.10.2-5.fc43

This library was designed to make it easier to access web services that claim to be "RESTful". A RESTful service should have urls that represent remote objects, which methods can then be called on. The majority of services don't actually adhere to this strict definition. Instead, their RESTful en...

[SECURITY] Fedora 44 Update: rest-0.10.2-9.fc44

This library was designed to make it easier to access web services that claim to be "RESTful". A RESTful service should have urls that represent remote objects, which methods can then be called on. The majority of services don't actually adhere to this strict definition. Instead, their RESTful en...

CVE-2026-11454

The Groundhogg WordPress plugin (versions <= 4.5.2) is affected by an Insecure Direct Object Reference via GET /wp-json/gh/v4/contacts/. The endpoint’s permission callback only checks a role-level view_contacts capability, and read_single() returns full contact records without object-level own...

CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

PT-2026-63428

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Manager versions prior to 20.2.0.0 Description An improper input validation issue exists within the REST API. A high privileged attacker with remote access could exploit this flaw to achieve elevation of privileges...

EUVD-2026-43090

vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions:...

CVE-2026-15087

vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions:...

CVE-2026-15087

vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions:...

CVE-2026-15087 Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078

vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions:...

CVE-2026-15087 Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078

vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions:...

CVE-2026-15087

The Drupal Clean RESTful module (versions . *) is subject to a security issue identified as CVE-2026-15087 . According to security advisories, the project is being marked as unsupported because of a known security issue that has not been fixed by the maintainer. While the specific root cause is n...

CVE-2026-15087: Improper Authentication

vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions:...

org.webjars.npm:draft-js (>=0.9.0, <=0.11.7), org.webjars.npm:github-com-marmelab-restful-js (0.9.6) +2 more potentially affected by CVE-2026-59879 via org.webjars.npm:immutable (3.7.6)

org.webjars.npm:immutable MAVEN version 3.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:immutable and may be impacted: - org.webjars.npm:draft-js =0.9.0, =0.5.5, =0.8.10 - org.webjars.npm:rc-editor-plugin-image 0.0.3 Source cves:...

org.webjars.npm:draft-js (>=0.9.0, <=0.11.7), org.webjars.npm:github-com-marmelab-restful-js (0.9.6) +2 more potentially affected by CVE-2026-59880 via org.webjars.npm:immutable (3.7.6)

org.webjars.npm:immutable MAVEN version 3.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:immutable and may be impacted: - org.webjars.npm:draft-js =0.9.0, =0.5.5, =0.8.10 - org.webjars.npm:rc-editor-plugin-image 0.0.3 Source cves:...

Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

an-website (>=22.6.13, <=22.6.25), avrofastapi (0.0.1) +9 more potentially affected by CVE-2024-6345 via setuptools (62.3.4)

setuptools PYPI version 62.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - an-website =22.6.13, =4.0.1, =0.0.1, =0.9.47, =0.4.10, =4.0.0, =2.3.0, =0.1.0, =0.1.1 Source cves: CVE-2024-6345 Source advisory:...