EUVD-2026-102952

Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network...

linux-explorer

This project is no longer maintained! Linux Expl0rer Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask. Capabilities ps View full process list Inspect process memory map & fetch memory strings easly Dump process memory in one click Automatically search hash in publi...

CVE-2026-77771

CVE-2026-77771 — miniOrange 2FA Free & Pro: 2FA Bypass via Session-Scoped OTP Lockout An authentication bypass in the miniOrange Two-Factor Authentication plugin for WordPress allows an attacker who already holds a victim's valid password to brute-force the second factor without limit, defeating...

Blackash-CVE-2025-61757

🚨 CVE-2025-61757 — Pre-Auth RCE Alert 🚨 🧩 Summary ID: CVE-2025-61757 Product: Oracle Identity Manager Oracle Fusion Middleware Component: REST WebServices Affected Versions: 12.2.1.4.0 & 14.1.2.1.0 Severity: 🔴 Critical — 9.8 CVSS 3.1 Published: Oct 21, 2025 Type: Missing Authentication for Critic...

CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-of-concept scanner and exploit helper for CVE-2026-14378 : unauthenticated administrator session takeover in the WordPress plugin DevKit Pro dplugins through a flawed user-switch “revert” flow. Legal: Use only on systems you own or have...

POC-CVE-2026-42826-2026-42826-Microsoft-Azure-DevOps-Information-Disclosure-Vulnerability

CVE-2026-42826 — Azure DevOps Information Disclosure PoC Overview Field| Value ---|--- CVE| CVE-2026-42826 CVSS| 10.0 Critical Microsoft / 7.5 High NVD CWE| CWE-200 Exposure of Sensitive Information to an Unauthorized Actor GHSA| GHSA-gmwx-3xm2-9fx8 Affected| Azure DevOps Services, Azure DevOps...

CVE-2026-105667 J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...

CVE-2026-105667

The J4Care dcm4che system contains a vulnerability where the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application in the default configuration. This lack of authentication allows a remote sender to reassign studies and related workflow records from on...

CVE-2026-105279 J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identit...

CVE-2026-105279

The J4Care dcm4che archive is vulnerable to a missing authentication flaw (CWE-306) in its default configuration. The system incorrectly accepts DICOM associations from unregistered calling AEs, allowing a remote peer to perform unauthorized actions. Specifically, an attacker can use C-FIND and C...

CVE-2026-80099

CVE-2026-80099 PoC Unauthenticated authentication bypass and RCE exploit targeting Newfold WordPress plugins that bundle wp-module-data. Overview This tool exploits a Bearer token validation flaw in the Newfold wp-module-data module. When a WordPress site using an affected Newfold plugin is not...

By-Poloss..-..CVE-2026-15038-POC

🚨 CVE-2026-15038 — InfiniteWP Client Admin Takeover Unauthenticated Admin Account Takeover in WordPress Multisite 📋 Overview InfiniteWP Client plugin for WordPress getoption'iwpclientactionmessageid' && !$iwpmmbcore-getoption'iwpclientpublickey' Reader : Uses getsiteoption → reads from...

Security update for glib2

This update for glib2 fixes the following issue: CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively y...

CVE-2025-32433-LAB

CVE-2025-32433 Vulnerability Research & Security Lab ✅ PRE-AUTH RCE CONFIRMED — Exploit successfully demonstrated. 📄 Technical Blog PDF : CVE-2025-32433-Technical-Blog.pdf 📸 Visual Evidence : screenshots/ 🔍 Proof of Concept Details : docs/PROOFOFCONCEPT.md CVE-2025-32433 is a CVSS 10.0 Critical...

CVE-2026-41940

CVE-2026-41940 - cPanel/WHM Auth Bypass Scanner & Exploit Tool cPanel/WHM Authentication Bypass Scanner & Exploit Tool for CVE-2026-41940 ⚠️ Disclaimer This tool is provided for educational purposes and authorized security testing only. By using this tool, you agree that: You will only test system...

CVE-2025-69985

FUXA ≤ 1.2.8 Auth Bypass + RCE CVE-2025-69985 📜 Description This Python exploit targets CVE-2025-69985, a critical authentication bypass vulnerability in FUXA web-based SCADA/HMI software versions ≤ 1.2.8. By sending a crafted JSON payload with embedded Node.js code to the unprotected...

flipper-mcp

flipper-mcp A Rust MCP Model Context Protocol server that runs directly on the Flipper Zero's WiFi Dev Board v1 ESP32-S2, enabling AI agents to control a Flipper Zero over the network. What is this? This project puts an MCP server on the Flipper itself. Any MCP-compatible AI client Claude Desktop...

CVE-2023-20198-Scanner

Cisco IOS XE CVE-2023-20198 Scanner A Python wrapper script for scanning Cisco IOS XE devices for the Web UI Authentication Vulnerability CVE-2023-20198 using a specific curl payload. Features Scans multiple targets from a file or command line Uses exact curl command as specified Automatically...

CVE-2026-64959

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...

CVE-2022-46169

CVE-2022-46169 This repository contains a Proof of Concept PoC for CVE-2022-46169 - Unauthenticated RCE on Cacti = 1.2.22 by chaining an Authentication Bypass and a Command Injection, described by Sonar in this blog post. The same vulnerabilities were also discovered by: Steven Seeley mrme of...