CVE-2026-19775 OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

CVE-2026-19775

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

CVE-2025-63572

説明 Zentrajuris v.1.0 のプラットフォームクライアント検索用エンドポイントにおいて、SQLインジェクションの脆弱性が発見されました。検索パラメータに送信されたユーザー入力は、適切なサニタイズ/パラメータ化が行われずにSQLクエリに直接連結されるため、攻撃者がクエリを操作することが可能となります。 影響を受けるエンドポイント iqopgbljnxmxlzvzbvgy.supabase.co/rest/v1/clients ペイロード例 パラメータ ?select=&limit=100 を追加し、Accept ヘッダを application/json に変更してください。...

CVE-2026-96272

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...

CVE-2023-51504

CVE-2023-51504 これはMotoCMS SQLインジェクションのDocker化された再現です（エクスプロイトDB参照） 説明 MotoCMS バージョン 3.4.3 のSQLインジェクション。リンク https://template189526.motopreview.com/store/category/search/?keyword=1 のkeywordパラメータを介して 脆弱性の再現には、Dockerfile内でKali Linuxマシンを再現し、sqlmapを実行して脆弱性を検出・結果表示するためのコマンドや指示を定義する必要がありました。...

CVE-2026-45381

Tautulli is a Python-based monitoring and tracking tool for Plex Media Server . In versions prior to 2.17.2 , the /search endpoint inserts a user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but no...

CVE-2026-45381 Tautulli: Reflected XSS in `/search` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

CVE-2026-45381: Improper Neutralization of Input During Web Page Generation

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

CVE-2026-33146

CVE-2026-33146 페이지 트리에서는 공유 항목이 깨끗해 보였지만, 검색 엔드포인트는 다른 이야기를 전했습니다. Docmost에서, 공개 공유 보기에서 숨겨진 제한된 하위 페이지가 여전히 공개 공유 검색 결과를 통해 유출될 수 있었습니다. 소개 Docmost오픈소스 협업 위키 및 문서화 플랫폼를 검토하던 중 아주 간단한 질문에서 이 문제를 발견했습니다. 의도적으로 공개 공유 보기에서 숨겨진 페이지가 있다면, 모든 공개 기능이 동일한 제한 경계를 존중하는가? 이 경우, 답은 '아니오'였습니다. 제한된 하위 페이지는 공개 ...

CVE-2022-22980

SpEL RCE Exploit - CVE-2022-22980 Spring Data に対する SpEL（Spring Expression Language）インジェクションを利用したリモートコード実行（RCE）エクスプロイト。 説明 脆弱性 このボックスは、SpEL インジェクションに対して脆弱なパラメータ trackingid を受け付けるエンドポイント /search を公開しています。このインジェクションにより、サーバー上で悪意のある Java 式を直接実行できます。 エクスプロイトの原理 1. Runtime.getRuntime.exec を介してシェルコマンドを実行...

CVE-2026-18120 Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier...

CVE-2026-91981 Vikunja before 2.6.0 User Enumeration via v2 API

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint...

NPM: n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

NPM: n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

GHSA-34FF-336R-5Q23 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

Impact The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain...

CVE-2026-86082

n8n , an open source workflow automation platform, is affected by a domain-restriction bypass in the OpenAI Chat Model node . The root cause is that the searchModels code path in loadModels.ts omitted the assertOpenAiCredentialAllowsUrl check, meaning the credential allowed-domain restrictions en...

CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...

SUSE CVE-2026-55496

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive ...

CVE-2026-82527: Improper Neutralization of Special Elements used in an SQL Command

R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can exploit the direct interpolation of filter keys into the SQ...

CVE-2026-77348

Wallos , an open-source self-hostable subscription tracker, ships a second unauthenticated logo-image search endpoint—endpoints/payments/search.php—that was missed when the original httpoxy SSRF fix (CVE-2026-33407) hardened endpoints/logos/search.php. Prior to version 5.0.0 , the endpoint passes...

EUVD-2026-68886

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...