CVE-2026-103267

Ghost versions before 6.62.0 are vulnerable to an authentication bypass during the staff invite acceptance process. This flaw allows users to specify arbitrary email addresses when creating an account. Specifically, attackers can utilize leaked invite tokens to register with attacker-controlled e...

CVE-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

EUVD-2026-90661

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

CVE-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

CVE-2026-103264

Fleet versions before 4.87.0 are vulnerable to an authentication bypass in the device API. The root cause is that the API accepts hostnames and hardware serials as authentication tokens alongside device UUIDs. Unauthenticated attackers capable of guessing these non-secret identifiers can authenti...

EUVD-2026-90658

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

CVE-2026-103244

The ground-station application, in versions prior to 0.8.0 , is vulnerable to an authentication bypass within the setup.restore command. This flaw allows unauthenticated attackers to execute arbitrary SQL during the initial first-run setup mode. By invoking setup.restore via Socket.IO , an attack...

CVE-2026-103244 ground-station before 0.8.0 Authentication Bypass via setup.restore

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session...

CVE-2026-103244 ground-station before 0.8.0 Authentication Bypass via setup.restore

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session...

EUVD-2026-90748

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session...

CVE-2025-29927

CVE-2025-29927 - Omisión de autenticación en middleware de Next.js Omisión avanzada 🔥 Resumen Un PoC avanzado para CVE-2025-29927 , que permite la omisión de autenticación en Next.js Middleware mediante la manipulación de cabeceras específicas. Esta plantilla mejora las técnicas de evasión de WAF...

CVE-2024-55591-POC

CVE-2024-55591 – Bypass de autenticación CLI por WebSocket en FortiOS PoC Esta es una herramienta de Prueba de Concepto PoC para explotar CVE-2024-55591 , una vulnerabilidad en FortiOS que permite acceso no autenticado a la CLI a través de WebSocket. Características Detección automática de la GUI...

CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities KEV, following reports of active exploitation. The vulnerability, tracked as CVE-2026-76504 CVSS...

CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 python3 check 0708 Existe una vulnerabilidad de ejecución remota de código en el Servicio de Escritorio Remoto – anteriormente conocido como Servicios de Terminal – cuando un atacante no autenticado se conecta al sistema objetivo mediante RDP y envía solicitudes...

webscreenshot

webscreenshot Description A simple script to screenshot a list of websites, based on the url-to-image PhantomJS script. Features Integrating url-to-image 'lazy-rendering' for AJAX resources Fully functional on Windows and Linux systems Cookie and custom HTTP header definition support for the...

CVE-2024-4358

Omisión de Autenticación en Telerik Report Server - CVE-2024-4358 Resumen En Progress Telerik Report Server, versión 2024 Q1 10.0.24.305 o anterior, en IIS, un atacante no autenticado puede obtener acceso a funcionalidades restringidas de Telerik Report Server mediante una vulnerabilidad de omisi...

Project-Deep-Focus

Deep Focus Una herramienta de reconocimiento de red de alto rendimiento para descubrir servicios y tomar sus huellas en rangos de IP. Diseñada para investigadores de seguridad y administradores de red. Tabla de Contenidos 1. Descripción general 2. Características 3. Requisitos 4. Instalación 5. U...

wafpass

WAFPASS ██╗ ██╗ █████╗ ███████╗██████╗ █████╗ ███████╗███████╗ ██║ ██║██╔══██╗██╔════╝██╔══██╗██╔══██╗██╔════╝██╔════╝ ██║ █╗ ██║███████║█████╗ ██████╔╝███████║███████╗███████╗ ██║███╗██║██╔══██║██╔══╝ ██╔═══╝ ██╔══██║╚════██║╚════██║ ╚███╔███╔╝██║ ██║██║ ██║ ██║ ██║███████║███████║ ╚══╝╚══╝ ╚═╝...