Kafka Connect validate API exposes provider secrets (CVE-2026-116593)
Builds before 4.2.2 and 4.3.2 can reveal configuration-provider values through the connector validation endpoint.
Stories per day · 30 days
3 RSS
Relatedwordpress4sql-injection3wp2shell3apache-kafka2information-disclosure2kafka-connect2authentication1authentication-bypass1cms1cve-2026-601371cve-2026-630301http-4011plone1poc1rce1unauthenticated1web-shell1zope1
12 stories, newest first · one card per story
Stories tagged #rest-api
Unauthenticated users can list Plone site users and groups
The October 22 fix covers sites with the Plone REST API enabled; results include user ids and full names.
HTTP 401 means the server rejected unproven credentials
Sucuri covers WordPress, server, and API causes, and when a sudden wave of 401s can indicate compromise.
WP2Shell chains two WordPress flaws into admin and web-shell access
Seqrite’s proof of concept uses CVE-2026-63030 and CVE-2026-60137 but does not show widespread live exploitation.
Chained WordPress flaws allow unauthenticated site takeover
WP2Shell chains CVE-2026-63030 and CVE-2026-60137; fixes are 6.8.6, 6.9.5 and 7.0.2.
Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication
Seqrite details WP2Shell, an unauthenticated WordPress chain combining two core flaws into remote code execution.
CVE-2026-92119: Apache Allura: REST API Mass Assignment
Apache Allura has a moderate-severity REST API mass-assignment flaw, CVE-2026-92119.
CVE-2026-103371: Apache Geode: Management REST API: Insertion of Sensitive Information into Log File
Moderate-severity Apache Geode Management REST API flaw logs sensitive information, with no exploitation reported.
WordPress 7.1.1 Fixes 11 Security Flaws Including Stored XSS and Path Traversal
WordPress 7.1.1 patches 11 core vulnerabilities, including stored XSS in wpautop() and an authenticated path traversal in the REST Templates Controller reported by Anthropic.
2
CVE-2026-82561: Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods
Apache NiFi 1.5.0-2.11.0 flow update REST methods lack authorization checks for referenced components, permitting unauthorized Process Group flow replacement (CVE-2026-82561).
"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)
CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.
4
CVE-2026-41870: Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)
Apache fixed CVE-2026-41870, a critical unauthenticated RCE via JEXL injection in Nutch Server's REST API affecting versions 1.11-1.22.