CVE-2021-33044

CVE-2021-33044 Dahua IPC/VTH/VTO devices auth bypass exploit Описание: Уязвимость обхода аутентификации идентификации, обнаруженная в некоторых продуктах Dahua в процессе входа в систему. Злоумышленники могут обойти аутентификацию устройства, формируя вредоносные пакеты данных. python3...

GHSA-826H-28H9-65HG Backstage: Improper authentication in the OIDC provider

Impact Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is...

EUVD-2026-94007

Backstage: Improper authentication in the OIDC provider...

CVE-2024-21762

CVE-2024-21762 - FortiGate SSL VPN RCE 検出および悪用ツール CVE-2024-21762 の検出および悪用ツール - FortiGate SSL VPN の重大な脆弱性 ⚠️ 法的注意 : このツールは許可されたテスト環境でのみ使用 してください。許可されていないシステムでの使用は違法 であり、深刻な法的結果を招く可能性があります。 概要 CVE-2024-21762 は、FortiGate SSL VPN コンポーネントにおける重大な脆弱性であり、認証前のリモートコード実行 RCE を可能にします。この欠陥は、Transfer-Encoding...

GHSA-MXMX-RH57-JX58 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

Platform members can delete owner issue dependencies through member-owned related issues Summary praisonai-platform issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but...

CVE-2026-105140

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user...

EUVD-2026-94311

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user...

CVE-2026-105140 Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user...

CVE-2026-105140 Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user...

CVE-2026-105140

The Obot platform versions 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 are vulnerable to a race condition within the auth provider group refresh mechanism. If overlapping refreshes for the same user commit out of order, the system may persist stale memberships , causing a user to retain revoked...

CVE-2026-105140 Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user...

F5-BIG-IP-exploit

F5-BIG-IP 익스플로잇 CVE-2022-1388 사용법: CVE-2022-1388.py -h -u URL -c COMMAND -f FILE CVE-2022-1388 F5 BIG-IP iControl REST 인증 우회 RCE 예: python3 CVE-2022-1388.py -u https://127.0.0.1 python3 CVE-2022-1388.py -u https://127.0.0.1 -c 'cat /etc/passwd' python3 CVE-2022-1388.py -f urls.txt Shodan 검색어:...

CVE-2026-97720 Apache Impala: Impala Executor Webserver Auth Bypass

Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token JWT signatures are...

CVE-2026-97720 Apache Impala: Impala Executor Webserver Auth Bypass

Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token JWT signatures are...

CVE-2026-97720

Apache Impala versions up to and including 4.5.2 are vulnerable to an authentication bypass in the Impala executors due to an incorrect implementation of JWT/OAuth authentication . Specifically, the system fails to validate Bearer token (JWT) signatures , causing the executor's webserver to accep...

kernel: nvmet-auth: reject short AUTH_RECEIVE buffers

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

CVE-2026-106460

A flaw was found in the @backstage/plugin-auth-node package. This vulnerability allows an authenticated attacker to achieve privilege escalation by assuming another user's catalog identity and gaining their access permissions. The issue occurs because the component does not consistently enforce...

AA Discord Audit

aa-discord-audit Сверочный аудит интеграции Alliance Auth с Discord. Сравнивает фактические назначения ролей в настроенной гильдии Discord с тем состоянием, которое отражено в Alliance Auth группы и состояние каждого пользователя, и закрывает лазейку, через которую модераторы могут вручную выдава...

Really Simple Security < 9.1.2 - Authentication Bypass

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

Next.js Middleware Bypass

Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2. The vulnerability allows attackers to bypass middleware security controls by sending a specially crafted 'x-middleware-subrequest' header, which can lead to authorization bypass and other securit...