Skip to main content
COSMICBYTEZLABS
NewsSecurityHOWTOsToolsTraining
StudyProjectsNewsletterHire MeAbout
Subscribe

Press Enter to search or Esc to close

News
Security
HOWTOs
Tools
Training
Study
Projects
Newsletter
Hire Me
About
RSS Feed
Reading List
Subscribe

Stay in the Loop

Get the latest security alerts, tutorials, and tech insights delivered to your inbox.

Subscribe NowFree forever. No spam.
COSMICBYTEZLABS

Your trusted source for IT intelligence, cybersecurity insights, and hands-on technical guides.

2614+ Articles
162+ Guides

CONTENT

  • Latest News
  • Security Alerts
  • HOWTOs
  • Checklists
  • Projects
  • Exam Prep

RESOURCES

  • Search
  • Browse Tags
  • Newsletter Archive
  • Reading List
  • RSS Feed

COMPANY

  • About Us
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CosmicBytez Labs. All rights reserved.

System Status: Operational
All tags
21 articles

#API Security

All CosmicBytez Labs articles tagged #API Security, across news, security advisories, how-to guides, and projects.

  • NewsAug 24, 2026

    South Korean Startup Platform Breach Exposes Critical Key Management Failures

    A breach at South Korea's government-backed startup platform leaked encrypted personal data after an encryption key was embedded directly in an API response.

  • SecurityAug 23, 2026

    CVE-2026-78122: docker-socket-proxy Fails to Gate Container Read Endpoints

    docker-socket-proxy's CONTAINERS guard bypassed via GET requests to /archive, /export, /logs, and /top, exposing arbitrary file reads.

  • SecurityAug 17, 2026

    SiYuan API Token Brute-Force via Missing Rate Limiting — CVE-2026-73056

    SiYuan's CheckAuth() middleware has no rate limiting, allowing unauthenticated attackers to brute-force API tokens and gain full admin access (CVSS 9.8).

  • SecurityAug 16, 2026

    SiYuan Column Width API Stored XSS (CVE-2026-73044)

    SiYuan before v3.7.4 allows stored XSS via unescaped table column width values in style attributes. CVSS 9.0 Critical. Patch to v3.7.4.

  • SecurityAug 16, 2026

    SiYuan API Authentication Has No Rate Limiting (CVE-2026-73046)

    SiYuan before v3.7.4 has no brute-force protection on its /api/* auth middleware, exposing the workspace to credential stuffing. CVSS 9.8.

  • SecurityAug 15, 2026

    CVE-2026-72822: Grav API Plugin 2FA Scope Bypass Allows Admin Account Takeover

    Grav API plugin before 1.0.13 fails to enforce API key scope caps on the disable2fa endpoint, enabling privilege escalation.

  • SecurityAug 15, 2026

    CVE-2026-72824: Grav API Plugin Twig Toggle Bypass Escalates Least-Privilege Keys

    Grav API plugin before 1.0.13 lets low-privilege API keys enable Twig processing on pages via a broken scope gate in PagesController.

  • SecurityAug 11, 2026

    CVE-2026-14450: MaaS API Auth Bypass via Forged HTTP Headers

    A critical CVSS 9.9 flaw in the MaaS API allows any pod within a Kubernetes cluster to bypass the Kuadrant AuthPolicy gateway by forging X-MaaS-Username and X-MaaS-Group headers, enabling full privilege escalation without authentication.

  • SecurityJul 24, 2026

    CVE-2026-47724: nebula-mesh API Authorization Bypass Enables Cross-Tenant Takeover (CVSS 9.9)

    A critical authorization bypass in nebula-mesh, the self-hosted control plane for Slack's Nebula VPN, allows any holder of a non-admin operator API key to...

  • SecurityJul 22, 2026

    CVE-2026-65007: Grav API Plugin Broken Authorization Allows API Key Takeover

    The Grav CMS API plugin before version 1.0.8 fails to properly authorize API key generation and revocation, allowing low-privilege users to generate admin...

  • SecurityJul 17, 2026

    CVE-2026-45695: Kopia Backup Tool Exposes Unauthenticated HTTP API

    A critical authentication bypass in Kopia, a cross-platform backup tool for Windows, macOS, and Linux, allows unauthenticated access to repository API...

  • SecurityJul 13, 2026

    CVE-2026-56260: Crawl4AI Arbitrary File Write in Docker API

    A critical CVSS 9.1 vulnerability in Crawl4AI before 0.8.7 allows attackers to write arbitrary files anywhere on the host filesystem via the Docker API's...

  • SecurityJun 26, 2026

    CVE-2025-71327: Flowise Authentication Bypass Grants Full API Access

    A critical authentication bypass in Flowise allows unauthenticated attackers to register accounts via an unprotected API endpoint and gain full platform...

  • SecurityJun 11, 2026

    CVE-2026-53469: migration-planner Missing Authorization on Bulk Delete

    A critical missing authorization vulnerability (CVSS 9.1) in Red Hat's migration-planner allows any authenticated user to send a DELETE request to...

  • SecurityJun 11, 2026

    CVE-2026-53471: migration-planner JWT Source ID Claim Not Validated in Agent API

    A critical improper authentication vulnerability (CVSS 9.6) in Red Hat's migration-planner agent-API middleware allows authenticated agents to update...

  • SecurityJun 4, 2026

    CVE-2026-49191: M3WebServer Hard-Coded API Keys Exposed via Error Pages

    A critical CVSS 9.8 vulnerability in M3WebServer hard-codes backend API keys in the production build. Attackers intercept them through verbose error handling…

  • SecurityApr 4, 2026

    CVE-2026-25197: IDOR Flaw Lets Authenticated Users Access

    A critical insecure direct object reference vulnerability allows authenticated users to pivot to any other user's profile by modifying an id parameter in...

  • SecurityApr 4, 2026

    CVE-2026-28766: Gardyn Smart Garden API Exposes All User

    A critical unauthenticated information disclosure vulnerability in the Gardyn smart garden platform exposes all registered user account information via a...

  • SecurityMar 30, 2026

    CVE-2026-5128: Steam Trader 2.1.1 Unauthenticated Sensitive

    A CVSS 10.0 critical vulnerability in steam-trader 2.1.1 exposes Steam account credentials, identity secrets, and shared secrets to unauthenticated remote...

  • SecurityMar 27, 2026

    CVE-2026-33669: SiYuan Unauthenticated Document Content

    A critical unauthenticated information disclosure vulnerability in SiYuan, the personal knowledge management system, allows remote attackers to retrieve...

  • SecurityMar 27, 2026

    CVE-2026-33670: SiYuan readDir Path Traversal Notebook

    A critical path traversal vulnerability in SiYuan's /api/file/readDir interface allows unauthenticated remote attackers to traverse notebook directories...