Web
2026
SMS Bombing via OTP Flooding on Jakarta Tax Portal
OTP endpoint on Jakarta tax portal has no server-side rate limiting, allowing
anyone to flood SMS messages to any phone number using government infrastructure.
Web
2026
GraphQL Thread Metadata Disclosure - Airbnb
Authorization inconsistency in ViaductGetThreadAndDataQuery endpoint leaks
partial thread metadata of other users via manipulated globalThreadId parameter.
Web
2026
Exposing 350 Enterprise Customers via BuddyBoss REST API - WordPress VIP
BuddyBoss REST API endpoint leaks PII of 350 WordPress VIP enterprise
customers to any authenticated low-privilege user.