CVE-2026-87820
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key
CVSS
5.3
Medio
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 9 sept 2026 · Última mod.: 9 sept 2026 · CWE-200
Sin historial EPSS suficiente todavía.
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
- github.comhttps://github.com/usmannasir/cyberpanel/commit/20484fd1786a424054386e5d6290d66b47cab3a3
- github.comhttps://github.com/usmannasir/cyberpanel/security/advisories/GHSA-qmwq-9cc8-x6h2
- www.vulncheck.comhttps://www.vulncheck.com/advisories/cyberpanel-2.4.3-through-2.4.5-information-disclosure-via-ai-scanner
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-867675.0 MED—
———Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester display names and profile links, locations, and expected check-in dates without parameter manipulation.11hCVE-2026-878105.3 MED—
——0Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages.13hCVE-2026-842225.3 MED—
——0The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.9hCVE-2026-810225.3 MED—
——0The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.9hCVE-2026-810215.3 MED—
——0The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.9hCVE-2026-803405.3 MED—
——0The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.9h