CVE-2026-76836 AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backendconfig property in backend/src/Entity/Station.php is annotated with GROUPGENERAL, and PUT /api/station/stationid/profile/edit in...

CVE-2020-5220

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...