CVE-2021-41191

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add `@require_apikey` in `BOT/lib/cogs/website.py` under the route for `/v1/products`.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-116

Affected software

VendorProductVersions
Redon-TechRoblox-Purchasing-Hub< 1.0.2

References

Timeline

Published
Oct 27, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-411926.5Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying tCVE-2021-411939.8wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions pCVE-2021-411949.8FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When JupyterCVE-2021-411955.5TensorFlow is an open source platform for machine learning. In affected versions the implementation of `tf.math.segment_*` operations resultCVE-2021-411965.5TensorFlow is an open source platform for machine learning. In affected versions the Keras pooling layers can trigger a segfault if the sizeCVE-2021-411975.5TensorFlow is an open source platform for machine learning. In affected versions TensorFlow allows tensor to have a large number of dimensioCVE-2021-411985.5TensorFlow is an open source platform for machine learning. In affected versions if `tf.tile` is called with a large input argument then theCVE-2021-411995.5TensorFlow is an open source platform for machine learning. In affected versions if `tf.image.resize` is called with a large input argument CVE-2021-41207.8snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to injectCVE-2021-412005.5TensorFlow is an open source platform for machine learning. In affected versions if `tf.summary.create_file_writer` is called with non-scalaCVE-2021-412017.8TensorFlow is an open source platform for machine learning. In affeced versions during execution, `EinsumHelper::ParseEquation()` is supposeCVE-2021-412025.5TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the `tf.ran
CVE-2021-41191: High severity, CVSS 7.5 | Vulnix