CVE-2026-101891 WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

CVE-2026-101891

An improper access control vulnerability exists in an internal API service on WatchGuard Access Points . This flaw allows an unauthenticated attacker with network access to the access point to obtain a valid API session . No specific exploit details or remediation steps are provided in the docume...

EUVD-2026-88362

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

CVE-2026-101891 WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

GO-2026-6482 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server...

CVE-2026-41940_exploit

============================================================================= CVE-2026-41940 - cPanel & WHM Authentication Bypass Exploit Vulnerability: Session-file manipulation through CRLF injection in cpsrvd's HTTP Basic authentication handler CVE: CVE-2026-41940 CVSS: 9.8 Critical CWE: CWE-9...

CVE-2026-36669-FengOffice

Security Advisory: CVE-2026-36669 Unauthenticated Arbitrary File Upload in Feng Office Community Edition An unauthenticated arbitrary file upload vulnerability exists in ckuploadhandler.php in Feng Office Community Edition version 3.11.13.11. This flaw allows remote, unauthenticated attackers to...

soplanning-1.52-exploits

Exploit Title: SOPlanning v1.52.00 'groupesave.php' XSS Reflected XSS Application: SOPlanning Version: 1.52.00 Date: 4/22/24 Exploit Author: Joseph McPeters Liquidsky Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/ Tested on: Linux CVE:...

CVE-2026-88805 Session Not Revoked Server-Side on Logout in Rancher

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

CVE-2026-88805 Session Not Revoked Server-Side on Logout in Rancher

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

CVE-2026-88805 Session Not Revoked Server-Side on Logout in Rancher

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

CVE-2026-88805

In SUSE Rancher versions 2.15 before 2.15.2 , a vulnerability exists where incorrect credential cleaning occurs during the logout process. This flaw allows remote attackers to maintain access credentials even after an account has been logged out. The CVSS v3.1 score is 8.1 (HIGH) , indicating a h...

CVE-2024-57427

CVE-2024-57427 - Reflected Cross-Site Scripting XSS PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting XSS. Multiple endpoints improperly handle user input, allowing malicious scripts to execute in a victim’s browser. Attackers can craft malicious links to steal...

CVE-2024-22853

CVE-2024-22853 D-LINK Go-RT-AC750 GORTAC750A1FWv101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a telnet session. PoC...

CVE-2017-14263

HoneywellNVRvul CVE-2017-14263 xfuturesec Co., Ltd First, obtain the SessionID for a guest user. We can find the SessionID from any http request. Such as: POST https://192.168.1.104/RPC2 HTTP/1.1 Accept: text/javascript, text/html, application/xml, text/xml X-Requested-With: XMLHttpRequest...

CVE-2023-0264

PoC for CVE-2023-0264 Keycloak vulnerability that allows session hijacking during authorization code flow See https://github.com/advisories/GHSA-9g98-5mj6-f9mv Prerequisites Docker curl jq python3 or another tool to serve static files on HTTP Steps to reproduce 1. Start Keycloak container with...

cyber-decoy

cyber-decoy A containerized network decoy honeypot that advertises SSH , RDP , and SMB , observes every inbound connection with eBPF , and reverse-proxies each session into an isolated decoy container. The design separates two concerns: 1. Observation. An eBPF TC classifier attached to the broker...

USN-8829-1 plasma-workspace vulnerability

Fabian Vogt discovered that Plasma Workspace did not properly authenticate local clients connecting to the session manager. A local attacker could possibly use this issue to execute arbitrary code as another user...

USN-8829-1: Plasma Workspace vulnerability

Fabian Vogt discovered that Plasma Workspace did not properly authenticate local clients connecting to the session manager. A local attacker could possibly use this issue to execute arbitrary code as another user...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: One QWORD Too Many in the Desktop Heap On Windows 11 Insider build 10.0.28020.2149, the user mode mapping of the Win32k desktop heap exposed a raw kernel session pool pointer at offset 0x100. The read itself is almost offensively small: ULONG64 leaked = ULONG64 desktopheap + 0x100...