CVE-2026-49468-LiteLLM-Auth-Bypass

CVE-2026-49468 — Обход аутентификации без авторизации в LiteLLM через путаницу маршрутов на основе Host-заголовка Обход аутентификации/авторизации до аутентификации в прокси LiteLLM BerriAI. Один поддельный заголовок Host заставляет прокси выполнять проверку аутентификации для публичного маршрута...

copyfail-rs

copyfail-rs PoC multi-vecteur + détection jumelée pour CVE-2026-31431 CopyFail. Inclut un nouveau vecteur de contournement d'authentification PAM qu'aucun autre PoC public ne propose. Le mode détection capture ce qu'AIDE / Wazuh / OSSEC / Tripwire ne peuvent structurellement pas détecter. Binaire...

wp2shell-scan

wp2shell-scan Detect and clean upwp2shell CVE‑2026‑63030 compromise across one or many WordPress sites. wp2shell is the pre‑authentication remote‑code‑execution vulnerability fixed in WordPress 7.0.2 / 6.9.5 / 6.8.6 2026‑07‑17. A public PoC appeared within a day and mass‑exploitation followed...

CVE-2026-105783

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI to RCE Exploit Обход пути до аутентификации через параметр 'tab' → Включение локальных файлов Обзор CVE-2026-9290 — это уязвимость высокого уровня опасности CVSS 7.5 неаутентифицированного включения локальных файлов в плагине WordPress WP User Manager – User...

PT-2026-107263

Name of the Vulnerable Software and Affected Versions Backstage versions 0.3.0 through 0.6.14 Backstage versions 0.7.0 through 0.7.4 Description The @backstage/plugin-auth-node package fails to consistently honor explicit negative email verification during shared OAuth profile normalization. This...

PT-2026-107269

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.4.20 Description The @backstage/plugin-auth-backend-module-oidc-provider package contains improper authentication within the OIDC provider. In deployments utilizing OIDC email-based identity resolution with a...

PT-2026-106318

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such manipulation of the argument user id leads to improper authentication. The attack can be executed remotely. The exploit is publicly available and mig...

PT-2026-106916

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An issue exists in the Proxy Auth component where incomplete cleanup allows an adjacent attacker to obtain sensitive information by sending crafted network traffic. Recommendations Upda...

CVE-2026-106488: Improper Authentication

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

CVE-2026-106460: Improper Authentication

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email...

PT-2026-107246

Name of the Vulnerable Software and Affected Versions @backstage/plugin-auth-backend-module-cloudflare-access-provider versions 0.1.0 through 0.4.9 Description Insufficient audience validation in the Cloudflare Access auth provider allows a user with a valid token for a different Access applicati...

CVE-2026-24061-setup

Настройка CVE-2026-24061 Этот репозиторий содержит Docker-настройку для CVE-2026-24061. После установки Docker просто выполните следующее: 1. Клонируйте этот репозиторий. 2. Выполните следующую команду: sudo docker build . --tag telnetd-auth-bypass 3. Когда Docker-образ будет собран, мы можем...

EUVD-2026-92876

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in use...

CVE-2026-105783

The Joplin note-taking application (prior to version 3.7.13 ) is vulnerable to cross-origin theft of a permanent API token when the optional Web Clipper server is enabled. The root cause is located in packages/lib/ClipperServer.ts, where the server sends Access-Control-Allow-Origin: * and fails t...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

EUVD-2026-92870

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

EUVD-2026-91794

LangGraph SDK custom auth silently ignores actions= on resource decorators...

CVE-2026-0073

Exploit de contournement d'authentification TLS ADB CVE-2026-0073 Un scanner réseau automatisé et un outil d'exploitation pour CVE-2026-0073 , une vulnérabilité dans le daemon Android Debug Bridge adbd qui permet l'exécution de code à distance RCE non authentifiée et un accès shell interactif via...