tag
Api
Ivanti Endpoint Manager Mobile (EPMM) Unauthenticated Remote API Access (CVE-2023-35078)
Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core) fails to enforce authentication on specific paths beneath its /mifs/aad/api/ administrative API. An unauthenticated remote attacker can issue a plain GET…
Hoverfly Middleware Command Injection to RCE (CVE-2025-54123)
Hoverfly exposes a middleware configuration API (/api/v2/hoverfly/middleware) that lets an authenticated admin register an external "middleware" process to pre/post-process simulated HTTP traffic, specified as a binary (interpreter/executable) plus a script…
FlowiseAI Account-Takeover via Forgot-Password Token Leak (CVE-2025-58434)
CVE-2025-58434 is an authentication-bypass vulnerability in FlowiseAI's password-reset flow: the forgot-password endpoint returns the password-reset tempToken directly in its JSON response body instead of only delivering it out-of-band (e.g., via email), and…
YAMCS Unauthorized User Enumeration via IAM API (CVE-2026-44595)
The YAMCS IAM REST API endpoints (listUsers, getUser, listGroups, getGroup) fail to enforce the required SystemPrivilege.ControlAccess authorization check. Any authenticated user, including one with no assigned privileges, can call these endpoints directly…
Vaultwarden Organization Collection Permissions Bypass & Cipher Enumeration (CVE-2026-26012)
CVE-2026-26012 is a broken access control vulnerability in Vaultwarden's organization cipher endpoint. The /api/ciphers/organization-details endpoint is reachable by any organization member regardless of their assigned collection permissions, and internally…
SmarterMail Unauthenticated Admin Password Reset (CVE-2026-0001 / WT-2026-0001)
SmarterMail exposes an /api/v1/auth/force-reset-password endpoint intended for authenticated self-service password resets, but the handler fails to validate the caller's identity when the request body sets IsSysAdmin to true. Sending a crafted JSON payload…
Langflow Unauthenticated Remote Code Execution via `validate/code` Endpoint (CVE-2026-0770)
Langflow exposes an API endpoint (/api/v1/validate/code) that is meant to validate user-submitted Python "component" code before it runs inside a workflow. The endpoint evaluates the submitted code using exec() with an execglobals context that is not…
Langflow Knowledge Base Path Traversal / Arbitrary Directory Deletion (CVE-2026-42048)
Langflow's DELETE /api/v1/knowledgebases bulk-delete endpoint accepts a list of kbnames values and builds a filesystem path for each by joining it onto the current user's Knowledge Base directory, without normalizing or validating that the resulting path…
Grafana Dashboard Permissions Broken Access Control — Editor-to-Admin Privilege Escalation (CVE-2026-21721)
This PoC demonstrates a broken-access-control flaw in Grafana's per-dashboard permissions API: an authenticated user holding only the Editor role can read and rewrite the ACL (/api/dashboards/uid/{uid}/permissions) for dashboards they do not own, and use it…
Gitea OAuth2 Scope Enforcement Bypass via HTTP Basic Auth — CVE-2026-28699
Gitea lets an OAuth2 application obtain an access token restricted to a subset of a user's permissions (e.g. read:user only), and enforces that restriction through a tokenRequiresScopes middleware. The middleware relies on an ApiTokenScope value that is…
FortiAuthenticator Unauthenticated RCE Endpoint Probe (CVE-2026-44277)
CVE-2026-44277 is described by the vendor/advisory as an unauthenticated remote code execution vulnerability in Fortinet FortiAuthenticator, caused by improper access control on specific API endpoints. The included script is a reconnaissance/detection tool…
Coolify Authenticated Remote Command Injection via Deployment Config (CVE-2026-34038)
Coolify builds shell commands for application deployment by interpolating user-supplied configuration fields — notably dockerfilelocation and predeploymentcommand — directly into shell strings executed inside the build/deploy container, without adequate…
Apache Superset Authenticated SQL Injection via sqlExpression/where Bypass — CVE-2026-23980
Apache Superset versions before 6.0.0 are vulnerable to an authenticated, error-based SQL injection reachable through the sqlExpression (adhoc column) or extras.where parameters of the /api/v1/chart/data REST endpoint. Superset's validateadhocsubquery()…
Azure Networking Privilege Escalation via Missing Privilege Check
CVE-2025-54914 is a critical privilege escalation vulnerability (CVSS 10.0) in Microsoft Azure Networking. Discovered by Mark Mallia and disclosed on September 4, 2025, the flaw arises from a missing authorization check in the GetRouteTable API code path. A…