CVE-2026-107720

The fast-jwt library (prior to version 6.3.1 ) contains a vulnerability in the createVerifier function where it incorrectly accepts unsigned JWTs. When a falsy synchronous key (such as an empty string or null) is provided alongside a non-empty algorithms allowlist , the library bypasses the prepa...

CVE-2026-107714

The Mechanize library (prior to version 2.14.1 ) contains a vulnerability where Mechanize::HTTP::Agent#response_redirect fails to consistently compare the scheme and port during redirects. If the host matches, the library may treat the redirect as same-origin even if the protocol changes or the p...

CVE-2026-107714 Mechanize sends credential headers to a different scheme or port after a redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

CVE-2026-11930

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers...

CVE-2026-107781

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server...

CVE-2026-107782

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to...

CVE-2026-4106

CVE-2026-4106: استغلال كشف المعلومات الشخصية PII غير المصادق عليه في HT Mega لووردبريس استغلال قوي متعدد الخيوط PoC لثغرة CVE-2026-4106 ، يستهدف إضافة HT Mega - Absolute Addons for Elementor لووردبريس الإصدارات 3.0.7. نظرة عامة على الثغرة تسجّل إضافة HT Mega عدة خطافات wpajaxnopriv مثل:...

AutoRepeater

AutoRepeater: تكرار طلبات HTTP الآلي باستخدام Burp Suite tl;dr داخل Extender، قم باستيراد ملف AutoRepeater.jar بعض الإرشادات المختصرة سيقوم AutoRepeater بإعادة إرسال الطلبات التي تم تغييرها بواسطة استبدال مُعرَّف فقط. عندما يستقبل AutoRepeater طلباً يطابق الشروط المحددة لتبويب معين، سيقوم...

EUVD-2026-95284

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers...

CVE-2026-11930 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers...

CVE-2026-11930

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) may not enforce authorization correctly for some web servers due to Improper Authorization (CWE-285). This vulnerability affects the standard appliances as well as the Contain...

terrapod-PoC

Terrapod : avis de sécurité Statut CVE : demandé, en attente d'attribution. Cette découverte est publiée sous GHSA-6qrc-597p-mrp9. À l'attribution de la CVE, ce dépôt est renommé CVE-YYYY-NNNNN-terrapod-PoC et cette bannière est remplacée par le lien CVE. | ---|--- Chercheur| Dostxodjayev Abdullo...

CVE-2026-1937

🔴 نظرة عامة على الثغرة CVE-2026-1937 — غياب التفويض → تحديث خيارات تعسفي → تصعيد الامتيازات الحقل| التفاصيل ---|--- معرّف CVE| CVE-2026-1937 الخطورة| عالية HIGH — درجة CVSS v3.1: 7.2 متجه الهجوم| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H الجهة المبلِّغة CNA| Wordfence الباحث| Daniel Basta whiz...

CVE-2026-107706

Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to...

CVE-2026-107782

System Informer versions prior to 4.0.26241.138 are vulnerable to an incorrect authorization vulnerability in the phsvc helper. This flaw allows local attackers to access privileged APIs by connecting via any Authenticode-signed process. Specifically, an attacker can load code into a Microsoft-si...

EUVD-2026-95259

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server...

EUVD-2026-95260

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to...

CVE-2026-107782 System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to...

CVE-2026-107781 Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server...

CVE-2026-107782 System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to...