Published file metadata, source observations, indicators, and research history in one bounded catalog.
100Reachable catalog records
2 / 5Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_2b1c34b54ad35e15c5Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
100 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
This week, we explore the opportunities and challenges in API security as we look ahead to the new year. We also include several newly discovered vulnerabilities and exploits of the embarrassingly common path traversal attack, and a look at OWASP insecure design. Before we dive into this week’s newsletter, the entire team at APISecurity.io extends [...] Read More... The post Issue 261: API Securit
First reported Dec 19, 2024 11:08 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of another CSRF vulnerability affecting an API, this time in the F5 BIG-IP device. We also have an article from Dark Reading on the next generation of supply chain attacks, a quick guide on how to hack APIs, and finally, a very illuminating report from Google Cloud on API security [...] Read More... The post Issue 210: CSRF vulnerability in F5, supply chain attacks, hacking
First reported Nov 30, 2022 09:02 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we share reports on the API exploits of two enterprising students and their takedown of “big laundry”. We take a revealing look at API vulnerabilities exposing millions of modems to remote takeover. We also have two insightful articles on API security in the supply chain and automotive industries, and ask the question what [...] Read More... The post Issue 248: API penetration of apps a
First reported Jun 20, 2024 07:21 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we review three different cases of API authorization and privilege escalation vulnerabilities, each of which is a wake-up call for API teams. We examine NIST updates on password security guidelines and share findings from an industry survey on API security and an upcoming OWASP API Top 10 webinar. Also this week we [...] Read More... The post Issue 256: Privilege escalation bugs in Kia
First reported Oct 10, 2024 16:07 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have an article on the value of using a developer portal for APIs, a guide from Dana Epp in finding “dark data” in an API, and an update from PortSwigger on their Web Security Academy resources for learning more about API security. We also have an update on the API vulnerabilities reported [...] Read More... The post Issue 236: Using a developer portal, dark data in APIs, an update o
First reported Dec 21, 2023 18:19 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have articles on the rise of API attacks that target shadow APIs, how API attacks on on e-commerce sites leak PII, views from Trendmicro on the importance of API runtime security, and a guide on API penetration testing. Article: API attacks target shadow APIs First up this week is a report from [...] Read More... The post Issue 204: API attacks on shadow APIs, PII leaks from e-commer
First reported Oct 14, 2022 16:19 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, the theme is AI, with articles on securing APIs against agentic misuse and preventing unintended behaviors. We cover two critical vulnerabilities in AI platforms Langflow and Dify, both caused by API security flaws, and highlight a major data leak due to unauthenticated internal APIs. Finally, we look at an engaging conversation around using [...] Read More... The post Issue 270: AI dou
First reported Apr 24, 2025 17:47 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have a report on how attackers are exploiting APIs faster than previously based on research into over 650 API-related vulnerabilities and a walkthrough guide into DVGA, a vulnerable GraphQL application. We also have further coverage of the Twitter API (this time an outage) and, finally, views from Dana Epp on the new [...] Read More... The post Issue 222: Attackers exploiting APIs fa
First reported Jun 11, 2023 17:44 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
Celebrating the 200th issue This week is a special one: it’s the 200th edition of this newsletter, and also my first anniversary as the curator. To celebrate, I have pulled out our three most popular articles and our three most popular guides, in case you missed them the first time around. We’ve also got views [...] Read More... The post Issue 200: Injection vulnerability in BitBucket, OAuth2 expl
First reported Sep 01, 2022 15:50 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we’re sharing five API vulnerability incidents that provide valuable insights into how APIs are commonly hacked and how to prevent these same vulnerabilities in your APIs. These incidents include the exposure of vehicle owner data from Volkswagen’s mobile app, enumeration vulnerabilities in Instagram and Tiktok APIs, an in-depth look at expression language injection [...] Read More... T
First reported May 22, 2025 13:47 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have an article from The New Stack on mastering the skills necessary to become an API security expert and another fine read from Dana Epp on the applicability of artificial intelligence (AI) in API defense and attack. We also have an article from Forbes on building cross-functional API teams and, finally, a [...] Read More... The post Issue 223 : Becoming an API security expert, AI f
First reported Jun 25, 2023 19:16 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of a record four API security related incidents. The first comes from Troy Hunt on a leakage on the new Spoutible social media site, with the second big ticket item being the leakage of 15 million profiles on Atlassian’s Trello. There’s also a report on the leakage of over 18,000 [...] Read More... The post Issue 240: Spoutible API leakage, 15M Trello profiles scraped, API
First reported Feb 22, 2024 13:06 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have articles on how DevOps teams can defend against API attacks, my views on how empathy for API developers can be a driver toward greater security, and eight measures to improve API security. We also have views on why API gateways might not be sufficient for API security, and finally, a report [...] Read More... The post Issue 195: How DevOps teams defend against API attacks, empat
First reported Jul 28, 2022 21:00 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we review the API security controls outlined by the FCC to prevent data breaches and examine multiple incidents of API data leaks exposing users’ personal data. We also cover a case of unsafe API consumption in the Docker ecosystem. Report: FCC weighs in with API security requirements The U.S. Federal Communications Commission (FCC) [...] Read More... The post Issue 251: FCC mandates AP
First reported Aug 01, 2024 15:33 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we focus on raising awareness about API vulnerabilities created by direct attacks against API development teams and tech stacks. We also share articles on safe use of API frameworks, and examine how OWASP API vulnerabilities are uncovered by bounty hunters. Article: How secure is your API SDLC? API teams can produce secure and [...] Read More... The post Issue 260: Attacking the API SDL
First reported Dec 04, 2024 16:50 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we share the Radware 2024 threat report highlighting APIs as a primary target of attacks. We also look at API vulnerabilities reported in the Medefer health platform and Zitadel’s identity management solution. The Hacker News investigates if Pentesters are about to go extinct, and finally we have an article on Open Banking and [...] Read More... The post Issue 267: AI to replace Pentest
First reported Mar 13, 2025 16:23 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of three vulnerabilities. First up is a supply chain vulnerability in the IBM Cloud platform, which is reported to be the first of its kind to affect a cloud provider. The second is another case of hardcoded API keys, this time in the Algolia AI search portal, and the third [...] Read More... The post Issue 213: Supply chain vulnerability in IBM Cloud, hardcoded API keys in
First reported Jan 26, 2023 18:43 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have articles on the threats to enterprises in the cloud and another on the looming threats to APIs. We also examine the challenges posed by API threats in the utility and energy sectors. We also have technical articles on using AI to hack the crAPI vulnerable API and how to generate SDKs [...] Read More... The post Issue 244: Threats to enterprises in the cloud, looming threats to A
First reported Apr 18, 2024 10:56 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of three vulnerabilities. The first is a vulnerability affecting the Wordle online puzzle allowing curious users to check solutions and even publish their own puzzles. The second is further coverage of the mass information leak from Twitter, and finally, we have coverage of an AWS IDAM API bypassing central CloudTrail [...] Read More... The post Issue 217: Wordle API expose
First reported Apr 28, 2023 03:56 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of a critical flaw with a popular API portal. We also have guides on securing GraphQL APIs and building bulletproof APIs and news of a new deliberately vulnerable API application. We also have an article on why fraud detection and API security must converge. Dana Epp wraps things up with [...] Read More... The post Issue 246: Critical flaw in API portal, securing GraphQL, b
First reported May 17, 2024 09:16 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we examine three recent API security incidents, uncovering valuable lessons to help you protect your APIs. We also highlight key insights from Jetbrains’ comprehensive developer survey, and explore an article on how teams inadvertently leak API keys and tokens through their Postman workspaces and what you can do about it. Breach: Black-listing fails [...] Read More... The post Issue 262
First reported Jan 03, 2025 13:16 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we take a deep dive into the Tinder API gateway and how it solves security challenges. We also have an article from Approov on how to protect runtime secrets for mobile APIs, and an article on Open Banking API security best practices. Finally, we look at how software bill of materials (SBOMs) can [...] Read More... The post Issue 207: Tinder API gateway, runtime secrets protection for m
First reported Nov 02, 2022 19:25 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we’re sharing some AI-related security news, with several reports highlighting vulnerabilities in trusted AI platforms. We also review a blog post claiming an API BOLA vulnerability at Mercury Energy New Zealand and cover a recent interview exploring a range of API security topics. First up though, news of a new OWASP Top 10 list [...] Read More... The post Issue 284: OWASP Top 10 2025,
First reported Nov 13, 2025 12:43 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we focus on secure API design and best practices. We examine Cloudflare’s latest measures to prevent API token exposure, analyze three recent API vulnerabilities affecting an AI platform, a WordPress plugin, and a popular LMS solution, and highlight key articles on DevSecOps and API security best practices. Article: How HTTPS redirects can expose [...] Read More... The post Issue 268: C
First reported Mar 27, 2025 15:55 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.