CVE-2026-20896

개념 증명 코드 CVE-2026-20896 이 스크립트는 Gitea API 경로 검증의 논리적 결함을 자동으로 악용하여, 인증 헤더의 디렉토리 탐색 공격을 통해 서버가 유효한 관리자 토큰을 부여하도록 강제합니다. !/usr/bin/env python3 PoC: Gitea Authentication Bypass CVE-2026-20896 Uso exclusivo para entornos controlados y auditorías autorizadas CTF import requests import sys import...

CVE-2025-7775-vulnerable-lab

CVE-2025-7775 취약한 실습 환경 이 저장소는 CVE-2025-7775에 대한 nuclei 템플릿을 테스트하기 위한 취약한 환경을 제공합니다. 실행 docker build -t vuln-app . docker run -d --name vuln-test -p 5000:5000 vuln-app 취약점 테스트 1. 원격 명령 실행 RCE curl -X POST http://localhost:5000/api/v1/configuration \ -H "Content-Type: application/json" \ -d...

CVE-2026-23744

CVE-2026-23744 — MCPJam Inspector 무인증 RCE CVE-2026-23744에 대한 무인증 원격 코드 실행 PoC입니다. MCPJam Inspector 1.4.2 및 이전 버전은 /api/mcp/connect를 통해 공격자가 제어하는 MCP 서버 명령을 인증 없이 실행할 수 있는 기능을 노출합니다. 승인된 테스트 및 연구 목적으로만 사용하십시오. 소유하지 않았거나 명시적 테스트 허가를 받지 않은 시스템에는 사용하지 마십시오. 동작 방식 HTTP POST - /api/mcp/connect -...

ThreatScraper

ThreatScraper ThreatScraper — это инструмент на Python, предназначенный для проверки информации о вирусах с использованием API VirusTotal. Он предлагает такие функциональные возможности, как планирование проверки в определённое время, отображение и сохранение графика тенденций обнаружения...

CVE-2026-76504 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CVE-2026-76504

A critical authentication bypass vulnerability exists in the Cisco Catalyst SD-WAN Manager API session-based authentication management. The root cause is improper handling of URI encoding (CWE-177) in HTTP requests, allowing an unauthenticated, remote attacker to bypass authentication rules and g...

EUVD-2026-89950

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation에서 메모리 API에 소유권 검사가 누락되어 교차 사용자 메모리 읽기 및 삭제가 가능했습니다. 기본 권고: GHSA-qv97-83w4-ff86 연구자 크레딧: @chaitanyagarware 한눈에 보기 필드| 값 ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 프로젝트| vmDeshpande/ai-agent-automation 패키지| backend 생태계| npm 심각도| 높음 CVSS| 8.8,...

CVE-2025-54123

CVE-2025-54123 Hoverfly: инъекция команд в RCE PoC Обзор Этот репозиторий содержит Python-скрипт Proof of Concept PoC для взаимодействия с экземплярами Hoverfly, затронутыми уязвимостью CVE-2025-54123. Скрипт поддерживает: Аутентификация с помощью имени пользователя и пароля Аутентификация с...

CVE-2022-29548

Эксплойт для проверки концепции для CVE-2022-29548: Проблема отраженного XSS существует в консоли управления нескольких продуктов WSO2. Это затрагивает API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0 и 4.0.0; API Manager Analytics 2.2.0, 2.5.0 и 2.6.0; API Microgateway 2.2.0; Data Analytics...

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

wordpress_exploit

Vulnerable Lab: CVE-2026-63030 WordPress This environment r...

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

EUVD-2026-89778

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

CVE-2026-103012

The Claude Code application is vulnerable to a security flaw where it prioritizes locally stored API keys (from previous logins or configurations) over the server-managed settings of a valid Claude Enterprise or Team account. If the settings endpoint rejects the stored key, the session may start ...

CVE-2022-40684

CVE-2022-40684 제작: 1vere$k 지금은 Fortinet FortiOS, FortiProxy 및 FortiSwitchManager 어플라이언스에 영향을 미치는 CVE-2022-40684의 POC 복사본입니다. https://github.com/horizon3ai/CVE-2022-40684 에서 복사했습니다. 분석 이 익스플로잇은 간단한 페이로드를 사용합니다: PUT /api/v2/cmdb/system/admin/admin HTTP/1.1 Host: Hostname User-Agent: Report Runner...

CVE-2026-13720

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

CVE-2026-13719

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0,...

EUVD-2026-89775

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

CVE-2026-13720

In Grafana , an Editor can forge file-provisioning metadata by creating a dashboard through the dashboard API . Due to a lack of authorization checks, the user can set the grafana.app/managedBy, grafana.app/managerId, and grafana.app/sourcePath annotations. This causes the dashboard to appear as ...