CVE-2026-107720 fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

CVE-2025-29927

Scanner de vulnérabilités avancé CVE-2025-29927 Ceci est un scanner de qualité professionnelle conçu pour détecter la vulnérabilité de contournement de middleware CVE-2025-29927 dans les applications Next.js. 🧠 Fonctionnalités Utilise un vrai navigateur headless Playwright pour explorer...

CVE-2021-38647

CVE-2021-38647 alias "OMIGOD" Un paquet Zeek qui détecte les tentatives d'exploitation de CVE-2021-38647 alias OMIGOD. https://corelight.com/blog/detecting-cve-2021-38647-omigod https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure...

CVE-2026-107714

The Mechanize library (prior to version 2.14.1 ) contains a vulnerability where Mechanize::HTTP::Agent#response_redirect fails to consistently compare the scheme and port during redirects. If the host matches, the library may treat the redirect as same-origin even if the protocol changes or the p...

CVE-2026-107714 Mechanize sends credential headers to a different scheme or port after a redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

CVE-2026-11930

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers...

CVE-2026-107781

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server...

CVE-2026-107782

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to...

CVE-2026-4106

CVE-2026-4106: Exploit de divulgation de PII non authentifié dans WordPress HT Mega Un exploit Proof of Concept PoC robuste et multi-thread pour CVE-2026-4106 , ciblant le plugin HT Mega - Absolute Addons for Elementor pour WordPress versions 3.0.7. Aperçu de la vulnérabilité Le plugin HT Mega...

AutoRepeater

AutoRepeater: répétition automatisée de requêtes HTTP avec Burp Suite tl;dr Dans Extender, importez AutoRepeater.jar Quelques brèves instructions AutoRepeater ne renverra que les requêtes modifiées par un remplacement défini. Lorsqu'AutoRepeater reçoit une requête qui correspond aux conditions...

CVE-2026-11930 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers...

EUVD-2026-95284

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers...

CVE-2026-11930

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) may not enforce authorization correctly for some web servers due to Improper Authorization (CWE-285). This vulnerability affects the standard appliances as well as the Contain...

monitorr-exploit-toolkit

Kit d'exploitation Monitorr RCE via téléversement de fichier non sécurisé reverse shell PHP, webshell, etc. Création de compte administrateur via contournement d'autorisation Fuite d'informations techniques : version de Monitorr, version de PHP, version du système et noyau, configuration PHP, etc...

terrapod-PoC

Terrapod: уведомление о безопасности Статус CVE: запрошен, ожидает присвоения. Эта находка опубликована как GHSA-6qrc-597p-mrp9. После присвоения CVE этот репозиторий будет переименован в CVE-YYYY-NNNNN-terrapod-PoC, а этот баннер заменён ссылкой на CVE. | ---|--- Исследователь| Dostxodjayev...

CVE-2026-1937

🔴 Aperçu de la vulnérabilité CVE-2026-1937 — Autorisation manquante → Mise à jour arbitraire des options → Élévation de privilèges Champ| Détails ---|--- CVE ID| CVE-2026-1937 Sévérité| ÉLEVÉE — Score CVSS v3.1 : 7.2 Vector| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence Chercheur|...

CVE-2026-107706

Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to...

CVE-2026-107782

System Informer versions prior to 4.0.26241.138 are vulnerable to an incorrect authorization vulnerability in the phsvc helper. This flaw allows local attackers to access privileged APIs by connecting via any Authenticode-signed process. Specifically, an attacker can load code into a Microsoft-si...

EUVD-2026-95260

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to...

EUVD-2026-95259

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server...