Skip to content
Threat Feed

Tag

Rce-Potential

3 briefs RSS
high advisory

Grav API Plugin Vulnerable to CORS Misconfiguration Allowing Data Exposure and Unauthorized Operations

The Grav API plugin before version 1.0.0-rc.16 contains a CORS misconfiguration that sets `Access-Control-Allow-Origin: *` by default, enabling an attacker to perform authenticated cross-origin requests from a malicious website after obtaining a valid API token, leading to sensitive data exfiltration and unauthorized write operations.

Grav API plugin web-vulnerability cors misconfiguration data-exfiltration rce-potential
1r 3t 1c
critical advisory

Grafana OnCall Unauthenticated Access Vulnerability (CVE-2026-63087)

A critical unauthenticated access vulnerability, CVE-2026-63087, in Grafana OnCall through version 1.16.11 allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to an internal plugin install endpoint using hardcoded default stack_id and org_id values, enabling authentication to all internal API endpoints, creation of arbitrary administrative users, and redirection of API calls to an attacker-controlled host.

Grafana OnCall unauthenticated-access grafana oncall vulnerability rce-potential
4t 1c
high advisory

Authentication Bypass in PraisonAI Call API via Host Header Spoofing (CVE-2026-61435)

PraisonAI versions prior to 4.6.78 contain an authentication bypass vulnerability in the Call API agent invocation endpoints when PRAISONAI_CALL_AUTH=disabled is configured, allowing an unauthenticated attacker to remotely list and invoke registered agents by sending a spoofed 'Host: 127.0.0.1' HTTP header.

PraisonAI authentication-bypass vulnerability web-application rce-potential
1r 2t 1c