#API Security
All CosmicBytez Labs articles tagged #API Security, across news, security advisories, how-to guides, and projects.
- News
Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks
JPCERT/CC says Japan logged 119 web data-leak incidents in 2026, driven by mobile API abuse and an unauthenticated Metabase SQLi flaw (CVE-2026-72898).
- Security
CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability
CISA added CVE-2026-5430 to its KEV catalog after active exploitation of a critical, unauthenticated WSO2 API management flaw.
- News
South Korean Startup Platform Breach Exposes Critical Key Management Failures
A breach at South Korea's government-backed startup platform leaked encrypted personal data after an encryption key was embedded directly in an API response.
- Security
CVE-2026-78122: docker-socket-proxy Fails to Gate Container Read Endpoints
docker-socket-proxy's CONTAINERS guard bypassed via GET requests to /archive, /export, /logs, and /top, exposing arbitrary file reads.
- Security
SiYuan API Token Brute-Force via Missing Rate Limiting — CVE-2026-73056
SiYuan's CheckAuth() middleware has no rate limiting, allowing unauthenticated attackers to brute-force API tokens and gain full admin access (CVSS 9.8).
- Security
SiYuan Column Width API Stored XSS (CVE-2026-73044)
SiYuan before v3.7.4 allows stored XSS via unescaped table column width values in style attributes. CVSS 9.0 Critical. Patch to v3.7.4.
- Security
SiYuan API Authentication Has No Rate Limiting (CVE-2026-73046)
SiYuan before v3.7.4 has no brute-force protection on its /api/* auth middleware, exposing the workspace to credential stuffing. CVSS 9.8.
- Security
CVE-2026-72822: Grav API Plugin 2FA Scope Bypass Allows Admin Account Takeover
Grav API plugin before 1.0.13 fails to enforce API key scope caps on the disable2fa endpoint, enabling privilege escalation.
- Security
CVE-2026-72824: Grav API Plugin Twig Toggle Bypass Escalates Least-Privilege Keys
Grav API plugin before 1.0.13 lets low-privilege API keys enable Twig processing on pages via a broken scope gate in PagesController.
- Security
CVE-2026-14450: MaaS API Auth Bypass via Forged HTTP Headers
A critical CVSS 9.9 flaw in the MaaS API allows any pod within a Kubernetes cluster to bypass the Kuadrant AuthPolicy gateway by forging X-MaaS-Username...
- Security
CVE-2026-47724: nebula-mesh API Authorization Bypass Enables Cross-Tenant Takeover (CVSS 9.9)
A critical authorization bypass in nebula-mesh, the self-hosted control plane for Slack's Nebula VPN, allows any holder of a non-admin operator API key to...
- Security
CVE-2026-65007: Grav API Plugin Broken Authorization Allows API Key Takeover
The Grav CMS API plugin before version 1.0.8 fails to properly authorize API key generation and revocation, allowing low-privilege users to generate admin...
- Security
CVE-2026-45695: Kopia Backup Tool Exposes Unauthenticated HTTP API
A critical authentication bypass in Kopia, a cross-platform backup tool for Windows, macOS, and Linux, allows unauthenticated access to repository API...
- Security
CVE-2026-56260: Crawl4AI Arbitrary File Write in Docker API
A critical CVSS 9.1 vulnerability in Crawl4AI before 0.8.7 allows attackers to write arbitrary files anywhere on the host filesystem via the Docker API's...
- Security
CVE-2025-71327: Flowise Authentication Bypass Grants Full API Access
A critical authentication bypass in Flowise allows unauthenticated attackers to register accounts via an unprotected API endpoint and gain full platform...
- Security
CVE-2026-53469: migration-planner Missing Authorization on Bulk Delete
A critical missing authorization vulnerability (CVSS 9.1) in Red Hat's migration-planner allows any authenticated user to send a DELETE request to...
- Security
CVE-2026-53471: migration-planner JWT Source ID Claim Not Validated in Agent API
A critical improper authentication vulnerability (CVSS 9.6) in Red Hat's migration-planner agent-API middleware allows authenticated agents to update...
- Security
CVE-2026-49191: M3WebServer Hard-Coded API Keys Exposed via Error Pages
A critical CVSS 9.8 vulnerability in M3WebServer hard-codes backend API keys in the production build. Attackers intercept them through verbose error handling…
- Security
CVE-2026-25197: IDOR Flaw Lets Authenticated Users Access
A critical insecure direct object reference vulnerability allows authenticated users to pivot to any other user's profile by modifying an id parameter in...
- Security
CVE-2026-28766: Gardyn Smart Garden API Exposes All User
A critical unauthenticated information disclosure vulnerability in the Gardyn smart garden platform exposes all registered user account information via a...
- Security
CVE-2026-5128: Steam Trader 2.1.1 Unauthenticated Sensitive
A CVSS 10.0 critical vulnerability in steam-trader 2.1.1 exposes Steam account credentials, identity secrets, and shared secrets to unauthenticated remote...
- Security
CVE-2026-33669: SiYuan Unauthenticated Document Content
A critical unauthenticated information disclosure vulnerability in SiYuan, the personal knowledge management system, allows remote attackers to retrieve...
- Security
CVE-2026-33670: SiYuan readDir Path Traversal Notebook
A critical path traversal vulnerability in SiYuan's /api/file/readDir interface allows unauthenticated remote attackers to traverse notebook directories...