Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-111643

Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
L429609201
Products
Misaka Danmu Server
CVE-2026-111644

Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
L429609201
Products
Misaka Danmu Server