Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.560 | 0,9 % |
| ≥10 % | 13.158 | 3,2 % |
| <10 % | 396.051 | 95,8 % |
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in October 2026, involves the exploitation of a c
N-able takes its remote access service offline after researcher publishes dozens of zero-day bugs
The remote access giant also urged its self-hosted customers to take down their own servers amid a "critical security incident," fearing the possibility of cyberattacks. Weiterlesen
Apple iMessage Group Chat Privacy Flaw iOS 27.2.1
HOC Shorts | Apple issued emergency software updates across its lineup—including iOS 27.2.1, iPadOS 27.2.1, macOS Golden Gate 27.2.1, visionOS 27.2.1, and watchOS 27.2.1—targeting serious privacy vulnerabilities. The Silent Join Bug (`CVE-2
I audited 100 third-party VS Code extensions. 19 ship known-CVE deps
Live Server — 84 million installs, the top row of the results below — bundles websocket-driver 0.7.4 and gets caught by CRITICAL GHSA-xv26-6w52-cph6 / CVE-2026-54466. It is the loudest finding in a scan of the top 100 third-party extensions
Fireworks AI meldet neue Sicherheitslücke nach Cloud-Provider-Hack
LONDON (IT BOLTWISE) – Der KI-Infrastruktur-Startup Fireworks hat nach einem Hack beim Cloud-Hosting-Anbieter eine weitere Sicherheitsverletzung offengelegt. Angreifer gelangten demnach zunächst über kompromittierte Entwicklungsmaschinen in
Critical Apache Airflow RCE Flaw Allows Attackers to Execute Code Without Authentication
Apache Airflow has a critical remote code execution flaw that lets anyone with write access to the Celery message broker run code on worker nodes. The attacker needs no credentials, DAG, or scheduler. The bug is tracked as CVE-2026-68982 an
CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability
CISA has flagged active exploitation of SSHole, an OpenSSH authentication bypass (CVE-2026-123158) that lets remote attackers access certain Linux accounts without a valid password or SSH key. The OpenSSH flaw affects specific server config
Hackers Exploit IBM Aspera Faspex Vulnerability, Granting Admin Access to Any User
IBM has released a security update for a critical IBM Aspera Faspex vulnerability that lets a signed-in user bypass access checks and gain full administrative privileges. Tracked as CVE-2026-123218, the flaw affects versions 5.0.0 through 5
CVE-2022-47421 | ARMember Plugin up to 4.0.4 on WordPress cross site scripting
A vulnerability, which was classified as problematic, was found in ARMember Plugin up to 4.0.4 on WordPress. The impacted element is an unknown function. Executing a manipulation can lead to cross site scripting. This vulnerability is track
CVE-2022-45828 | NooTheme Noo Timetable Plugin up to 2.1.3 on WordPress cross-site request forgery
A vulnerability was found in NooTheme Noo Timetable Plugin up to 2.1.3 on WordPress and classified as problematic. This impacts an unknown function. Executing a manipulation can lead to cross-site request forgery. The identification of this
CVE-2022-4146 | Hitachi Replication Manager prior 8.8.5-02 Expression Language expression language injection (hitachi-sec-2023-123)
A vulnerability classified as critical was found in Hitachi Replication Manager. Affected is an unknown function of the component Expression Language Handler. Such manipulation leads to improper neutralization of special elements used in an
CVE-2022-34155 | OAuth Single Sign On Plugin up to 6.23.3 on WordPress authorization
A vulnerability labeled as critical has been found in OAuth Single Sign On Plugin up to 6.23.3 on WordPress. Affected by this issue is some unknown functionality. Executing a manipulation can lead to missing authorization. The identificatio
CVE-2022-4952 | OmniSharp csharp-language-server-protocol up to 0.19.6 JSON Serializer SerializerBase.cs CreateSerializerSettings resource consumption (ID 902)
A vulnerability has been found in OmniSharp csharp-language-server-protocol up to 0.19.6 and classified as problematic. This vulnerability affects the function CreateSerializerSettings of the file src/JsonRpc/Serialization/SerializerBase.cs
CVE-2022-47593 | RapidLoad Power-Up for Autoptimize Plugin up to 1.6.35 on WordPress sql injection
A vulnerability, which was classified as critical, has been found in RapidLoad Power-Up for Autoptimize Plugin up to 1.6.35 on WordPress. Impacted is an unknown function. Performing a manipulation results in sql injection. This vulnerabilit
CVE-2022-47172 | HasThemes ShopLentor Plugin up to 2.6.2 on WordPress cross-site request forgery
A vulnerability labeled as problematic has been found in HasThemes ShopLentor Plugin up to 2.6.2 on WordPress. Affected by this vulnerability is an unknown functionality. The manipulation results in cross-site request forgery. This vulnerab
CVE-2022-47164 | MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce Plugin cross-site request forgery
A vulnerability classified as problematic has been found in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce Plugin up to 3.7.7 on WooCommerce. This affects an unknown part. Performing a manipulation results in cross
CVE-2022-46850 | Easy Media Replace Plugin up to 0.1.3 on WordPress denial of service
A vulnerability has been found in Easy Media Replace Plugin up to 0.1.3 on WordPress and classified as problematic. This impacts an unknown function. The manipulation leads to denial of service. This vulnerability is uniquely identified as
CVE-2022-46651 | Apache Airflow up to 2.6.2 information disclosure
A vulnerability classified as problematic has been found in Apache Airflow up to 2.6.2. The impacted element is an unknown function. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2022-466
CVE-2022-45855 | Apache Ambari up to 2.7.6 SpringEL injection
A vulnerability labeled as critical has been found in Apache Ambari up to 2.7.6. This issue affects some unknown processing of the component SpringEL Handler. Executing a manipulation can lead to injection. This vulnerability is handled as
CVE-2022-42009 | Apache Ambari up to 2.7.6 Server Agent injection
A vulnerability categorized as critical has been discovered in Apache Ambari up to 2.7.6. Impacted is an unknown function of the component Server Agent. Executing a manipulation can lead to injection. This vulnerability appears as CVE-2022-
CVE-2022-38062 | Metagauss Download Theme Plugin up to 1.0.9 on WordPress cross-site request forgery
A vulnerability described as problematic has been identified in Metagauss Download Theme Plugin up to 1.0.9 on WordPress. This affects an unknown part. Such manipulation leads to cross-site request forgery. This vulnerability is uniquely id
CVE-2022-23447 | Fortinet FortiExtender Management Interface up to 7.0.3 Web Request path traversal (FG-IR-22-039)
A vulnerability was found in Fortinet FortiExtender Management Interface up to 7.0.3. It has been classified as critical. This issue affects some unknown processing of the component Web Request Handler. Performing a manipulation results in
CVE-2022-22302 | Fortinet FortiGate up to 6.4.1 Apple Push Notification Service cleartext storage
A vulnerability, which was classified as problematic, has been found in Fortinet FortiGate up to 5.5.0/6.0.13/6.1/6.2.9/6.4.1. This affects an unknown part of the component Apple Push Notification Service/Google Cloud Messaging Service. Thi
CVE-2021-4189 | Python FTP Client Library return value (EUVD-2021-34049 / Nessus ID 211144)
A vulnerability was found in Python and classified as problematic. This impacts an unknown function of the component FTP Client Library. Executing a manipulation can lead to unchecked return value. This vulnerability is handled as CVE-2021-
CVE-2025-39827 | Linux Kernel up to 6.17-rc3 net rose_rt_free reference count (EUVD-2025-29587 / Nessus ID 265306)
A vulnerability classified as critical has been found in Linux Kernel up to 6.1.149/6.6.103/6.12.44/6.16.4/6.17-rc3. This issue affects the function rose_rt_free of the component net. The manipulation leads to improper update of reference c
CVE-2025-39955 | Linux Kernel up to 6.16.8 net/ipv4/tcp_timer.c tcp_disconnect denial of service (EUVD-2025-33328 / Nessus ID 272003)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.16.8. This impacts the function tcp_disconnect of the file net/ipv4/tcp_timer.c. Performing a manipulation results in denial of service. This vulnerab
CVE-2025-39953 | Linux Kernel up to 6.16.8 cgroup cgroup_lock_and_drain_offline allocation of resources (EUVD-2025-32383 / Nessus ID 274816)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.16.8. This impacts the function cgroup_lock_and_drain_offline of the component cgroup. Executing a manipulation can lead to allocation of resources. This v
Chrome zero-day whack-a-mole continues as 2026 tally hits 8
Google has patched its eighth actively exploited Chrome zero-day of 2026, matching its total for the whole of last year with nearly two months still left on the calendar.The latest flaw, tracked as CVE-2026-125350, is a high-severity use-af
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c
CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before
CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the s
CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm
CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is pas
CVE-2026-17401 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17400 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17399 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not suffic
CVE-2026-17398 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17397 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17396 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17395 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently r
CVE-2026-17394 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could
CVE-2026-17392 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neut
CVE-2026-17391 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17390 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page an
CVE-2026-17389 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory l
CVE-2026-17388 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17387 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17385 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17383 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
CVE-2026-17382 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
CVE-2026-17381 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.
CVE-2026-17380 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access sensitive information belonging to other tenants due to improper validation of a path parameter. A path value in a request is not sufficiently validated, which could allow a user to reach data outside their own tenant.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access sensitive information belonging to other tenants due to improper validation of a path parameter. A path value in