Published file metadata, source observations, indicators, and research history in one bounded catalog.
100Reachable catalog records
3 / 5Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_2b1c34b54ad35e15c5Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
100 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
This week, we have news of a critical API vulnerability that allowed a researcher to demonstrate a proof of concept attack allowing remote vehicle takeover. We have articles on three reasons why QA teams should learn API hacking and the new changes GitHub has made to API versioning to future-proof client code. Finally, we have [...] Read More... The post Issue 212: Remote control of vehicles, API
First reported Jan 15, 2023 14:31 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, an Authy API was misused to verify the registered phone numbers of millions of users and recent injection attacks are prompting US security agencies to promote secure by design for software development. A research team demonstrates IoT hacking via API. As this is a significant milestone for 42Crunch and APIsecurity.io, namely our 250th [...] Read More... The post Issue 250: Authy API br
First reported Jul 18, 2024 12:07 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of a recent API token breach affecting the popular Hugging Face AI portal and a vulnerability in the SonicWall firewall affecting 178,000 instances. We also have a comprehensive API security checklist and a guide on selecting the most suitable API gateway for Kubernetes environments. Finally, we have a practical guide [...] Read More... The post Issue 239: Hugging Face API
First reported Feb 08, 2024 18:40 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of API and web security flaws in the Lego marketplace, potentially allowing for a full account takeover. From NordicAPIs, we have a guide to seven examples of quality API style guides and coverage of the recent news from 42Crunch being admitted to the Microsoft Intelligent Security Association (MISA). Finally, we [...] Read More... The post Issue 215: API flaws in Lego mark
First reported Mar 05, 2023 16:22 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of two high-profile breaches. First up is the Dropbox breach, potentially affecting millions of users, and then the Dell breach, affecting 49 million records. We also have details of a vulnerability in the Next.js component. We also have a free on-demand recording from Microsoft Build on Navigating the Depths of [...] Read More... The post Issue 247: Dropbox and Dell breach
First reported May 31, 2024 15:47 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have a very popular API testing checklist aimed at pen-testers, a comprehensive guide to tips & tricks, and resources related to API security and API pen-testing. We also have an article from Cisco on using CVSS to tackle API security, and finally, a 10-year journey in API security vulnerabilities with Ivan Novikov. [...] Read More... The post Issue 194: API testing checklist, API se
First reported Jul 21, 2022 15:47 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have a pair of doubleheaders — firstly, The New Stack on six API trends for 2024 and how API keys are leading to vulnerabilities, and then Kin Lane (aka. APIEvangelist) on the future of API gateways and why API discovery is hard. We also have an article on threat modeling for API [...] Read More... The post Issue 237: Six API trends for 2024, API keys leading to vulnerabilities, the
First reported Jan 10, 2024 17:54 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have important news of a vulnerability in the OAuth social sign-in feature of many popular platforms, potentially impacting billions of users. We have two articles from The NewStack, the first a guide on securing your API gateway and the second how to design scalable SaaS API security. We also have news of [...] Read More... The post Issue 233: Flaws in OAuth social sign-in, securing
First reported Nov 16, 2023 21:12 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we dive into detailed reports of vulnerabilities impacting Intel, McDonald’s, and the social media app TeaForHer, each with valuable lessons for API security. We also look at the latest news and rising costs from the Optus 2022 API breach. Finally, we highlight an insightful article offering practical tips for designing APIs for efficient [...] Read More... The post Issue 278: OWASP API
First reported Aug 21, 2025 15:05 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we focus on automotive cybersecurity. Guest contributor Ling Cheng of VicOne shares the security benefits of the Pwn2Own Automotive event. We explore Sam Curry’s success uncovering API flaws at Subaru; car hacking as a career choice; and CISA director Jen Easterly’s case for secure design, inspired by automotive safety. In February, I’ll chat [...] Read More... The post Issue 264: Pwn2O
First reported Jan 30, 2025 16:59 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have two vulnerabilities — the first is the revelation that thousands of applications are leaking Twitter access tokens, and the second is a parameter smuggling attack in Golang affecting some well-known Golang-based projects. We also have an article on the benefits of API catalogs in delivering security benefits and, finally, a fascinating [...] Read More... The post Issue 197: Apps
First reported Aug 14, 2022 19:18 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, the UK’s NCSC released detailed API security guidelines. Lorna Mitchell offers practical strategies for managing large OpenAPI files. Pieter Danhieux advocates for developer-focused security training in Australia. We also share best practices to secure your Postman collections and cover recent API vulnerability incidents at Zabbix and Shopware. Article: UKs NCSC promotes secure API [...
First reported Apr 10, 2025 16:53 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
Welcome to this first edition of the APIsecurity newsletter for 2026, I’m Philippe Leothaud, CTO and co-founder of 42Crunch, and your new Newsletter Editor. I’d like to thank Anthony Lonergan for the excellent work he’s done over the years building this newsletter into a trusted source for API security news and insights. I’ll continue that [...] Read More... The post Issue 287: Critical RCEs in n8
First reported Jan 15, 2026 14:18 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have articles on the surge in API attacks as cybercriminals increasingly target financial services and new data on the silent threat of APIs. We have a retrospective on the recent Jumpcloud incident from an API perspective and a great guide on seven things about API security from Philippe de Ryck. We conclude [...] Read More... The post Issue 232: API attacks surge, the silent threat
First reported Nov 01, 2023 22:57 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we cover the promise and pitfalls of using AI for API security, along with newly discovered vulnerabilities in Web Application Firewalls and emerging Vibe Coding platforms. We explore strategies for building APIs optimized for AI integration, and highlight a critical vulnerability in a popular API development framework that developers should be aware of. [...] Read More... The post Issu
First reported Aug 07, 2025 12:34 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, the theme is API authorization gone wrong. Guest contributor Rob Spectre kicks off a new interview series exploring real-world authorization failures. We also dive into case studies with key lessons for API security teams, including a look at the missteps that led to a £2.3M fine for 23andMe, and data exposure from the [...] Read More... The post Issue 274: Authorization nightmares, API
First reported Jun 19, 2025 15:14 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of two API-related data breaches: the first in Urlscan.io API, which was found to be leaking sensitive URLs and data, and the second a phishing attack on Dropbox, where private GitHub repositories were copied. We also have an article on the importance of contract testing for microservices, and finally, another [...] Read More... The post Issue 208: Urlscan.io leaks sensitiv
First reported Nov 09, 2022 19:44 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have a report from Imperva on the increasing security incidents caused by unsecured APIs. We also have articles on using policy-as-code to improve API security, views on how common assumptions may prevent effective API protection, and how open APIs are improving cloud-based security. Report: One in thirteen incidents blamed on API insecurity [...] Read More... The post Issue 191: API
First reported Jun 29, 2022 16:35 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have articles on the economics of API attacks, and how developers can prevent them, and how to create an API solution wishlist with developers in mind. We also have technical articles on understanding cross-origin resource sharing (CORS) for APIs and how to secure APIs by blocking compromised tokens. We also have a [...] Read More... The post Issue 243: Economics of API attacks, unde
First reported Apr 09, 2024 16:00 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of an API vulnerability in the popular Jetpack WordPress plugin affecting millions of websites, an article on how to address growing API security vulnerabilities in 2023, and an article on why API security is the need of the hour. Finally, we have a guide from Port Swigger on how to [...] Read More... The post Issue 226 : Jetpack WordPress plugin has API vulnerability, how
First reported Aug 10, 2023 17:47 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of a API vulnerability allowing privilege escalation in the team chat tool Zulip. We also have articles from PortSwigger on the threat of broken access controls and injection attacks to APIs, as well as a quick read on Broken Object Level Authorization vulnerabilities. Finally, we feature a guide from the [...] Read More... The post Issue 199: Vulnerability in Zulip server,
First reported Aug 25, 2022 16:59 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we look at API security vulnerabilities discovered in Versa Director and in dating app Feeld. We share insights from ethical API hackers on how they find API vulnerabilities and bugs in mobile apps. We have two separate reports on industry trends and priorities for API security in 2024, and a how-to article on [...] Read More... The post Issue 255: Versa Director API flaw, Feeld BOLA vu
First reported Sep 26, 2024 13:00 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of three separate API vulnerabilities within the popular cloud-native continuous deployment platform. We also have a report covering the views of Gartner on the current state of API security and an article on distributed identity as a key element of modern API security. Finally, we have a guide on how [...] Read More... The post Issue 218: Three Argo CD API exploits, distri
First reported May 05, 2023 14:43 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we examine an industry report uncovering critical API vulnerabilities in solar power devices, and a recent case of API directory traversal flaws affecting LG Smart TVs. We also look at common weaknesses in the APIs for password-reset services, and finally review insights from the latest Stack Overflow Developer Survey on what developers are [...] Read More... The post Issue 280: Solar d
First reported Sep 18, 2025 13:27 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.