CVE-2026-60206

CVE-2026-60206 – Oracle WebLogic Server SAML 인증 우회 PoC 이 저장소는 Oracle WebLogic Server의 SAML 구현에서 발견된 심각한 인증 우회 취약점인 CVE-2026-60206 에 대한 개념 증명PoC 익스플로잇을 제공합니다. 이 결함으로 인해 원격의 낮은 권한을 가진 공격자가 SAML 어서션assertion을 위조하여 서버를 완전히 장악할 수 있습니다. ⚠️ 면책 조항: 이 도구는 승인된 보안 연구 및 테스트 목적으로만 사용됩니다. 소유하거나 명시적 테스트 권한이 있는...

CVE-2026-24061

CVE-2026-24061 auth-bypass.py: минималистичная реализация CVE-2026-24061 с использованием UV + Python + telnetlib3 run.sh / shell.sh: собирает и запускает эксплуатируемый контейнер podman на localhost:2323...

Important: Red Hat Security Advisory: iscsi-initiator-utils security update

An update for iscsi-initiator-utils is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket

A flaw was found in open-iscsi. An incorrect authorization vulnerability allows unprivileged local users to bypass authentication for the iscsiuio control socket. This enables unauthorized access to the control socket, potentially leading to system compromise or disruption of iSCSI Internet Small...

CVE-2023-21768-DSE-Bypass

포크됨 이 프로젝트는 다음에서 포크되었습니다: WindowsLPEAFDCVE-2023-21768 . 업데이트 이 프로젝트는 chompie1337 익스플로잇에서 업데이트되었으며, DSE를 비활성화하고, 서명되지 않은 드라이버를 로드한 후 DSE를 활성화합니다...

CVE-2026-58575

Dell PowerStore is affected by an Authentication Bypass by Spoofing vulnerability that allows an authenticated attacker to escalate privileges to Administrator . The CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-exploitable conditions with l...

EUVD-2026-69060

Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate privileges to Administrator...

CVE-2026-58575

Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate privileges to Administrator...

CVE-2020-14882-WebLogic-Analysis

漏洞研究：在 Oracle WebLogic Server 中利用 CVE-2020-14882 与 CVE-2020-14883 漏洞链 该仓库包含一份技术报告（Write-up）和概念验证（Proof of Concept，PoC），用于演示 Oracle WebLogic Server 管理控制台组件中认证绕过（Authentication Bypass）与远程代码执行（RCE）漏洞链的利用。 🛑 警告与免责声明： 本材料仅用于教育目的及合法的安全审计（渗透测试）。未经所有者事先书面同意，针对系统使用所述技术将依法追究责任。 🏗 研究架构与技术栈 目标： 部署了 Oracle...

CVE-2022-36537

CVE-2022-36537 Сводка R1Soft Server Backup Manager использует платформу ZK в качестве основной. Её безопасность требует, чтобы все участники Web3-проектов уделяли больше внимания уязвимостям безопасности различных Web3-инфраструктур и своевременно их устраняли, чтобы избежать потенциальных рисков...

CVE-2026-84200

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-77194

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the...

CVE-2026-83595

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,...

RLSA-2026:61378 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP...

EUVD-2026-69063

A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function validatesqlsafety of the file openchatbi/text2sql/generatesql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 throu...

CVE-2026-71554

A flaw was found in h2, a Python library for HTTP/2. This vulnerability allows a remote attacker to perform request smuggling. The library incorrectly processes HTTP/2 requests that contain more than one Host header. When these requests are downgraded to HTTP/1.1 by a consuming application, the...

CVE-2026-73653

A flaw was found in Vitest. A remote attacker, by sending specially crafted commands to the Browser Mode API, could bypass file access restrictions. This allows the attacker to read, create, overwrite, or delete arbitrary files on the system where Vitest is running, even when file write permissio...

EUVD-2026-69035

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200

Kyverno versions v1.9.0 through v1.12.7 are affected by a policy exception handling flaw . When a policy in enforce mode is combined with two PolicyExceptions , the less restrictive exception takes precedence. An attacker can exploit this by crafting a resource name that matches the second except...