Category - API Security Blog

The improper default setting in JiranSoft CrossEditor4 on Windows, Linux, Unix (API modules) potentaily allows Stored XSS. This issue affects CrossEditor4: from 4.0.0.01 before...Read More ...

July 17, 2025

curl: [High] Arbitrary File Write via Path Traversal in cURL CLI (`-o`, `–output`) (CWE-22: Improper Limitation of a Pathname to a Restricted Directory)

Vulnerability description not...Read More ...

July 17, 2025

Fastify: Remote Code Execution via unsafe usage of `reply.view({ raw })` in @fastify/view (EJS template engine)

The @fastify/view plugin, when used with the EJS engine and the reply.view({ raw: <user-controlled-string> }) pattern, allowed arbitrary EJS execution. This vulnerability arose from the ...

July 17, 2025

curl: Speculative Execution Side-Channel in `curl`

Vulnerability description not...Read More ...

July 17, 2025