Published file metadata, source observations, indicators, and research history in one bounded catalog.
100Reachable catalog records
4 / 5Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_2b1c34b54ad35e15c5Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
100 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
This week: we share a report about OneLogin suffering an API data leak, we also have Cloudflare’s postmortem on an accidental API DoS. We look at researcher Dirk-jan Mollema’s disclosure of a critical Entra ID vulnerability, also incidents of mass assignment and excessive data exposure in Rancher and Apache Airflow APIs, and finally Nokia platforms [...] Read More... The post Issue 281: OneLogin l
First reported Oct 02, 2025 11:28 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have an article from Forbes on why API security is critical in 2023, views from Kin Lane on being pedantic about API contract testing, and a preview of a new tool for API security testing. We also have details of an upcoming webinar on API security within a GitHub environment. Article: Why [...] Read More... The post Issue 224 : API security is critical in 2023, API contract testing,
First reported Jul 06, 2023 13:53 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we take a look at Vodafone’s journey to API Governance with both challenges and benefits. We review news about the latest patch updates to the OpenAPI specification, and tips for API prototyping using OpenAPI description files. We also have multiple incidents of APIs with OWASP vulnerabilities like broken authentication and security misconfiguration. Article: [...] Read More... The post
First reported Nov 07, 2024 16:04 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have another excellent guide from Dana Epp, this time focusing on hacking .Net applications in the real world. We have coverage on the recent Radware 2022 state of API security report and views from Matthew Reinbold on using ChatGPT for API design. Article: Real-world guide to hacking a .Net application Dana Epp [...] Read More... The post Issue 216: Hacking a .Net application, state
First reported Mar 27, 2023 09:00 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we focus on incidents of data exposure through vulnerable APIs. We examine a new report of data leaks in YouTube and Google APIs, vulnerabilities in open-source projects, and API hacks at healthcare and automotive companies. On a positive note, we share an update from the OpenAPI Initiative on the latest specifications for Overlays [...] Read More... The post Issue 265: YouTube API priv
First reported Feb 13, 2025 14:45 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of an API authentication bypass vulnerability in the Ivanti Sentry cybersecurity product and a report into Docker images that are exposing APIs and private keys. We also have articles on API security’s role in protecting retail apps, how APIs and generative AI interoperate, and how attackers bypass Web Application Firewalls. [...] Read More... The post Issue 231: API authen
First reported Oct 18, 2023 17:04 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we look at the growing number of penalties that companies can now face in the event of a data breach. We also learn about critical API vulnerabilities discovered in Cisco and Traccar products. VicOne recently published a white paper on automotive API security, and we also want to highlight a LinkedIn post on [...] Read More... The post Issue 253: Breached companies face litigation, SQL
First reported Aug 29, 2024 20:51 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have a timely article on the five best practices for ensuring the security of 3rd party APIs, a deep-dive guide into the OAuth2 step-up authentication protocol, and two separate articles on the danger of hidden APIs, namely shadow and zombie APIs. We conclude with not one but two excellent guides from Dana [...] Read More... The post Issue 228: 3rd party API security, OAuth2 step-up
First reported Sep 07, 2023 22:08 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, the main news is coverage of the huge data breach affecting the Australian telecommunications company Optus, with APIs as a likely root cause. We also have articles on API security, authentication and authorization vulnerabilities, and how Docker REST API exposure can present risks. Breach: APIs at the root of Optus data breach? The [...] Read More... The post Issue 203: Optus data brea
First reported Oct 07, 2022 11:58 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have views from the Google Cloud team on their four pillars of API security and a great article from the NewStack on using Cerbos to add permissions to your APIs. Dana Epp shares his thoughts on attacking predictable GUIDs when hacking APIs and, finally, a quick read on the developer’s need for [...] Read More... The post Issue 214: Google Cloud’s four pillars of API security, Cerbos
First reported Feb 09, 2023 19:18 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we dive into API governance and API best practices, analyze a recently reported IDOR vulnerability at the Indian Post Office, and examine an SQL injection bug in the API of a popular Fintech platform. Finally, we review an API authorization vulnerability in Gitlab’s password reset mechanism. Article: How Netflix and HSBC implement API [...] Read More... The post Issue 266: API governanc
First reported Feb 27, 2025 16:55 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, our theme is API authorization vulnerabilities. We cover critical issues discovered in the WSO2 API Manager and the Better-Auth plugin, share an eye-opening BOPLA vulnerability in a Formula 1 registration API, and examine familiar API security flaws appearing more often in industrial devices. We also highlight a recent interview with former CISA director [...] Read More... The post Issu
First reported Oct 30, 2025 15:27 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of a recent vulnerability in the Money Lover finance app, and a report into a recent vulnerability in Toyota vehicles, which, according to Toyota, did not result in malicious access. We have an article featuring the views of popular contributor Corey Ball on missing API flaws by using conventional testing [...] Read More... The post Issue 219: Money Lover app exposes user d
First reported May 12, 2023 15:30 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we look at the recent data breach at the Internet Archive and the critical role of API token management. We have a report from Trend Micro detailing security issues with API Gateway deployments, and we look at recently discovered OWASP API vulnerabilities in popular enterprise and open source platforms. Also a quick look [...] Read More... The post Issue 257: Internet Archive under atta
First reported Oct 24, 2024 12:34 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of the so-called “GhostToken” vulnerability affecting Google Cloud. We also have articles from Gartner on a report on zero trust not being a silver bullet, how authentication attacks threaten API security, and finally, why API security is everywhere except where you need it. Vulnerability: GhostToken vulnerability in Google Cloud This [...] Read More... The post Issue 227:
First reported Aug 25, 2023 13:15 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we examine a World Poker Tour website hack and also the exposure of Nagios Log Server API credentials, we explore an article on the causes of API drift, review common injection attacks targeting APIs, and highlight how DDoS campaigns are increasingly focusing on API endpoints. Vulnerability: Security Pros Go All In on Poker [...] Read More... The post Issue 282: Poker Hacks, Credential
First reported Oct 16, 2025 15:03 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we share API security incidents from across different industries, highlighting the common vulnerabilities that continue to surface, from government web portals and security platforms to industrial equipment, home devices, and even service robots at your local restaurant. Vulnerability: Tax Records Leak with API IDOR Flaw Researcher Aseem Shrey disclosed an Insecure Direct Object [...] R
First reported Sep 04, 2025 22:59 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, in our final 2025 issue of APISecurity.io, we look back at the five most frequent API vulnerabilities covered in the newsletter over the past 12 months. These issues highlight common mistakes teams make in API development and can help to spotlight where security efforts can deliver the biggest opportunity to reduce risk. I’d [...] Read More... The post Issue 286: The APISecurity.io Top
First reported Dec 10, 2025 15:01 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of a vulnerability affecting the OAuth2 implementation on the Booking.com website. We have a report from Approov on their research into financial apps in the Google Play store and another great article from Dana Epp on API security checklists. Finally, we cover an interview with Matias Madou on the need [...] Read More... The post Issue 220: API flaw in Booking.com, apps le
First reported May 25, 2023 16:10 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we look at a sharp rise in API security incidents across Asia-Pacific, and a critical API vulnerability in the dating app Raw. We also explore two credential-related incidents: one involving leaked OAuth credentials, and another highlighting the risks from long-lived API keys. Finally, a deep dive into the growing problem of API sprawl [...] Read More... The post Issue 271: API breaches
First reported May 08, 2025 14:04 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have an article on the rise in API breaches as a result of credential leakage and how this can be addressed by using “MFA for APIs”. We also have a thought-provoking read on how to select an API gateway based on its security characteristics and a brief review of PCI DSS 4.0’s [...] Read More... The post Issue 221: Credential leakage fueling API breaches, API gateway security, PCI DSS
First reported Jun 03, 2023 12:41 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have two vulnerabilities: an API vulnerability in the Delinea platform and a remote command execution (RCE) affecting Palo Alto PAN-OS devices. We also have articles on how to fix API design, seven ways to better manage supply chain risk, and whether OpenBanking will transform the future of finance. Finally, we have Dana [...] Read More... The post Issue 245: Delinea patches API vuln
First reported May 03, 2024 09:56 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we look at how long-standing API security failures are being amplified by automation, AI, and increasingly aggressive exploitation timelines. From agentic AI vulnerabilities in ServiceNow to authentication bypasses actively exploited in SmarterMail and Fortinet infrastructure, this issue highlights how broken authentication and authorization continue to dominate real-world incidents. We
First reported Jan 29, 2026 17:17 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
This week, we have news of an API vulnerability in the Travis CI platform that allowed to access logs on public instances, leading to leaking keys and tokens. Also this week, we have an excellent guide from Microsoft on their recommendations how to mitigate against API threats, some views from the Economic Times on why [...] Read More... The post Issue 189: Vulnerability in Travis CI log API, Micr
First reported Jun 15, 2022 17:00 UTCCatalog metadata updated Oct 08, 2026 03:40 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.