CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Ahsay AhsayCBS API Authentication Bypass Vulnerability (CVE-2026-105133) Security Advisory
[Affected Scope] All AhsayCBS installations running versions up to 9.15.2.69 and 10.3.4.44.
[Impact] Unauthenticated remote attackers can bypass the system password verification logic to gain full administrative access to the backup server.
[Mitigation] Immediately upgrade to version 9.15.2.70, 10.3.4.45, or later as per vendor instructions.
Ivanti Endpoint Manager Mobile (EPMM) API Authentication Bypass Vulnerability (CVE-2025-4427) Urgent Security Advisory
[Affected Scope] Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and prior
[Impact] Unauthenticated remote attackers can bypass authentication via the API component to access protected resources and sensitive data without credentials
[Mitigation] Immediately apply the official vendor security patches and restrict external access to the API endpoints
Cisco Smart Licensing Utility (CSLU) Static Administrative Credentials Vulnerability (CVE-2024-20439) Analysis and Hardening Guide
[Affected Scope] Cisco Smart Licensing Utility (CSLU) versions prior to 2.3.0
[Impact] Unauthenticated remote attackers can gain full administrative access to the CSLU application API using hardcoded static credentials
[Mitigation] Immediately upgrade CSLU to version 2.3.0 or later, and restrict external access to the CSLU API ports using firewalls
Twilio Authy API Information Disclosure and Phone Number Enumeration Vulnerability (CVE-2024-39891) Analysis & Mitigation Guide
[Affected Scope] Twilio Authy API endpoints accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0
[Impact] Unauthenticated attackers can verify whether specific phone numbers are registered with Authy, enabling large-scale enumeration and targeted phishing/social engineering attacks
[Mitigation] Immediately update mobile applications to the latest versions (Android 25.1.0+ / iOS 26.1.0+) and enforce strict rate limiting on API gateways
Ivanti EPMM (formerly MobileIron Core) Authentication Bypass and Remote Code Execution Vulnerability (CVE-2023-35082) Urgent Security Advisory
[Affected Scope] Ivanti EPMM (Endpoint Manager Mobile) 11.10 and older, and MobileIron Core 11.2 and older
[Impact] Unauthenticated remote attackers can bypass authentication to access restricted API endpoints, compromise sensitive data, or execute arbitrary commands
[Mitigation] Immediately upgrade to the latest supported release and restrict external access to administrative API endpoints
Strapi Sensitive Information Disclosure via Query Filter Vulnerability (CVE-2023-22894)
[Affected Scope] All Strapi deployments running version 4.5.5 or earlier.
[Impact] Authenticated attackers with admin panel access can leak sensitive user data, including password hashes and reset tokens, via side-channel inference.
[Mitigation] Immediately upgrade Strapi to version 4.6.0 or later.
Joomla! 4.x Improper Access Check in Webservice Endpoints Information Disclosure Vulnerability (CVE-2023-23752) Analysis and Mitigation Guide
[Affected Scope] Joomla! versions 4.0.0 through 4.2.7
[Impact] Unauthenticated remote attackers can bypass access controls to access sensitive API endpoints, exposing database credentials and system configuration details
[Mitigation] Immediately upgrade Joomla! to the patched version (4.2.8 or higher) and rotate all database credentials