Category - API Security Blog

curl: TOCTOU Race Condition in HTTP/2 Connection Reuse Leads to Certificate Validation Bypass

Vulnerability description not...Read More ...

September 14, 2025

PT-2025-37398

A vulnerability was identified in Selleo Mentingo 2025.08.27. This issue affects some unknown processing of the file /api/course/enroll-course of the component Create New Course Basic Settings. Such m ...

September 14, 2025

PT-2025-37401

In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first...Read More ...

September 14, 2025

curl: Security check up

Vulnerability description not...Read More ...

September 14, 2025

Malwarebytes: Replayable Password Change Request Across Sessions.

Vulnerability description not...Read More ...

September 14, 2025

curl: Vulnerability Report: Public Exposure of Security Audit File

Vulnerability description not...Read More ...

September 14, 2025

WakaTime: Unauthorized Disclosure of Private Emails via WakaTime Private Leaderboards

The vulnerability allowed unauthorized disclosure of private email addresses of WakaTime users through the private leaderboards feature. The email addresses were exposed to leaderboard creators and me ...

September 14, 2025

curl: Stack use-after-scope in HTTP/3 POST request processing via CURLOPT_POSTFIELDS

Vulnerability description not...Read More ...

September 14, 2025