EUVD-2026-92796

Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers...

GHSA-97RH-RHH2-7VJV Payload: Remote Code Execution through first-register

Impact A crafted request to the public first-register operation can be used to perform a RCE exploit. You are affected if: - You use local auth strategy and your application remains without an initial user created Patches In the patched version data submission to create first user is properly...

EUVD-2026-93990

Backstage: Insufficient audience validation in the Cloudflare Access auth provider...

GHSA-Q333-F498-W2X7 Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Impact The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be...

Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Impact The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be...

GHSA-XM5Q-P7W3-X6CP Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Impact Several Passport-based authentication providers use shared OAuth profile normalization from @backstage/plugin-auth-node. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The...

EUVD-2026-93995

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization...

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Impact Several Passport-based authentication providers use shared OAuth profile normalization from @backstage/plugin-auth-node. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The...

CVE-2021-33044

CVE-2021-33044 Dahua IPC/VTH/VTO أجهزة تجاوز التحقق من الهوية - استغلال حول: ثغرة تجاوز التحقق من الهوية الموجودة في بعض منتجات Dahua أثناء عملية تسجيل الدخول. يمكن للمهاجمين تجاوز التحقق من هوية الجهاز عن طريق بناء حزم بيانات ضارة. python3 dahuaexploit.py --ip IP --port PORT...

EUVD-2026-94007

Backstage: Improper authentication in the OIDC provider...

GHSA-826H-28H9-65HG Backstage: Improper authentication in the OIDC provider

Impact Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is...

CVE-2024-21762

CVE-2024-21762 - FortiGate SSL VPN RCE Detection & Exploitation Tool Detection and exploitation tool for CVE-2024-21762 - Critical FortiGate SSL VPN vulnerability ⚠️ LEGAL DISCLAIMER : This tool is for authorized test environments only. Unauthorized use on systems is ILLEGAL and may result in...

GHSA-MXMX-RH57-JX58 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

Platform members can delete owner issue dependencies through member-owned related issues Summary praisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but...

CVE-2026-105140

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user...

CVE-2026-105140 Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user...

CVE-2026-105140 Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user...

CVE-2026-105140 Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user...

EUVD-2026-94311

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user...

CVE-2026-105140

The Obot platform versions 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 are vulnerable to a race condition within the auth provider group refresh mechanism. If overlapping refreshes for the same user commit out of order, the system may persist stale memberships , causing a user to retain revoked...

F5-BIG-IP-exploit

F5-BIG-IP exploit CVE-2022-1388 usage: CVE-2022-1388.py -h -u URL -c COMMAND -f FILE CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE Eg: python3 CVE-2022-1388.py -u https://127.0.0.1 python3 CVE-2022-1388.py -u https://127.0.0.1 -c 'cat /etc/passwd' python3 CVE-2022-1388.py -f urls.txt Shod...