A business-logic flaw let any free account mint permanent, signed reward perk URLs for a paid membership tier, with a self-chosen far-future expiry that survived account deletion and had no rate limit.
May 23, 2026A public share link on a major news site's AI chat product leaked the owner's internal user id, which then unlocked unauthenticated read, planting, and deletion of every conversation that user ever had, including chats that were never shared.
May 22, 2026An enterprise identity service exposed encrypt and decrypt endpoints to every tenant under one shared master key with no context binding, letting any customer recover any other customer's live API credentials.
May 20, 2026An insurer's quote-store endpoint accepted writes against any customer's identifier with no ownership check, letting any anonymous visitor silently poison any in-flight quote across five sibling brands.
May 20, 2026Three GraphQL resolvers on a feature-flag and observability platform were missing authentication, exposing 15,915 cross-tenant records and accepting persistent writes from any unauthenticated caller.
May 20, 2026A retrieve-quote API was vulnerable to error-based SQL injection on the insurer's production database, exposing hundreds of tables across all sibling brands to unauthenticated reads.
May 19, 2026A wildcard browser message target on a consumer review platform's login popup leaked the authorization code to any cross-origin page, allowing a one-click silent email rebind and permanent business account takeover.
May 19, 2026An unauthenticated retrieve-quote endpoint accepted candidate quote numbers and returned full customer PII for valid ones, with no challenge and no rate limit, across five sibling insurance brands.
May 18, 2026An auth-bypass flag on a home-insurance retrieve endpoint exposed full customer dossiers including saved card data, mortgagee banks, and direct-debit bank details, with no authentication.
May 17, 2026An insurer's message-centre endpoint converted any Australian mobile number into the matching customer's full identifiable record, with no authentication, across five sibling brands.
May 17, 2026