13 matches found
EUVD-2026-87365
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
CVE-2026-100418
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
CVE-2026-100418
The software Flame through 2.4.0 contains an information exposure vulnerability within the unauthenticated GET /api/config endpoint. The root cause is a lack of field redaction, allowing the endpoint to return the entire configuration object. Attackers can send a single unauthenticated request to...
CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
PT-2026-99130
Name of the Vulnerable Software and Affected Versions Flame versions prior to 2.4.1 Description An information exposure issue exists in the unauthenticated 'GET /api/config' endpoint, which returns the complete configuration object without redacting sensitive fields. This allows an attacker to...
CVE-2026-100418: Exposure of Sensitive Information to an Unauthorized Actor
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
Malicious code in @loybung/weather-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b8141e9c6d2ba6d7cf52aea200f4a596b4e7151c2c3a67b2713cd2cacc96038 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-4809 Malicious code in @loybung/weather-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b8141e9c6d2ba6d7cf52aea200f4a596b4e7151c2c3a67b2713cd2cacc96038 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Top Tips for Weather API Integration and Data Utilization
Integrate weather APIs to enhance your app with real-time data, forecasts, and personalized insights. Improve user experience while…...
Potential API key leak
If a user is actively blackholing the location or weather APIs, or those APIs become otherwise unavailable, it is possible for the API keys to get leaked to the active IRC channel. This is patched in v1.2.4...
