Har1Sh-K

**Name of the Vulnerable Software and Affected Versions** Frigate version 0.17.1 **Description** An issue exists where the 'GET /api/logs/{service}' endpoint allows any authenticated user, including those with the viewer role, to download Frigate and nginx logs. This exposure includes auto-generated admin passwords and camera credentials contained within request query strings, which can lead to privilege escalation from a viewer to an administrator. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Home Assistant versions prior to 2026.6.0 **Description** The Konnected integration registers an HTTP endpoint 'KonnectedView' (located in homeassistant/components/konnected/ init .py) that is configured to not require authentication. While write requests (POST and PUT) are processed by the `update sensor()` function and correctly validate the `Authorization: Bearer <token>` header, read requests (GET) are handled by a separate `get()` method that lacks any authentication checks. This allows unauthenticated read access to the endpoint. **Recommendations** Update to version 2026.6.0.