EUVD-2026-69577

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete...

CVE-2026-19766 Authentication Bypass leads to Administrative control of adjacent network hosts in HPE Networking Fabric Composer

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete...

CVE-2026-19766

HPE Networking Fabric Composer is affected by an authentication bypass vulnerability in the underlying operating system. An unauthenticated adjacent attacker can exploit this to execute arbitrary code as a privileged user , resulting in complete compromise of the AFC host . The NVD rates this as ...

CVE-2026-8181

CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — 認証バイパスによる管理者アカウント乗っ取り 脆弱性概要 WordPress プラグイン Burst Statistics のバージョン 3.4.0 から 3.4.1.1 には、認証されていない認証バイパス の脆弱性があり、完全な 管理者アカウント乗っ取り につながります。この深刻な欠陥により、任意の管理者ユーザー名を知っている認証されていない攻撃者が、1 回の HTTP リクエストでそのアカウントの有効な WordPress...

CVE-2026-29000

JWT/JWE 认证绕过 PoC 一个概念验证 PoC 脚本，演示利用 JSON Web 令牌 JWT 和 JSON Web 加密 JWE 实现的认证绕过漏洞。该工具通过接受未经验证的 JWT（alg: none）并将其包裹在有效的 JWE 结构中，来利用那些未正确验证令牌算法的环境。 工作原理 该漏洞利用链利用了常见的加密实现缺陷： 1. 密钥提取： 脚本访问目标公开暴露的 jwks（JSON Web 密钥集）端点，并下载服务器的 RSA 公钥。 2. 令牌伪造： 它伪造一个未经验证的假 JWT 负载，授予 ROLEADMIN 权限。故意将算法头部设置为 "alg": "none"。 ...

CVE-2026-41940

⚠️ CVE-2026-41940 - Omisión de autenticación en cPanel & WHM Omisión crítica de autenticación previa en cPanel & WHM 📌 Resumen CVE-2026-41940 es una vulnerabilidad crítica de omisión de autenticación que afecta a cPanel & WHM y WP Squared. Un atacante remoto no autenticado puede omitir por complet...

auth-bypass-CVE-2025-40554

CVE-2025-40554 – SolarWinds Web Help Desk 认证绕过 PoC Shodan 查询 root@kitploit: http.favicon.hash:"1895809524" Nuclei root@kitploit: nuclei -u https://TARGET:8443 -t CVE-2025-40554.yaml nuclei -l listtarget.txt -t CVE-2025-40554.yaml root@kitploit: pip install -r requirements.txt 用法 单目标（绕过 + 登录，默认...

GHSA-2M8G-3CMR-WG3W Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...

EUVD-2026-56888

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests...

GHSA-G47C-3XMW-Q6M2 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

CVE-2024-27348-HugeGraph-RCE

CVE-2024-27348: Apache HugeGraph RCE（高度なサンドボックス回避） CVE-2024-27348 （Apache HugeGraph Server におけるリモートコード実行）のための高度で信頼性の高い Proof of Concept（PoC）エクスプロイトです。 公開されている多くの PoC はコマンドを盲目的に実行したり、Java の Runtime.exec の制限により複雑なペイロードで失敗したりしますが、本スクリプトは実際のペネトレーションテストシナリオにおける信頼性 を考慮して設計されています。 ⚠️ 免責事項...

CVE-2026-78597 Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation

Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...

EUVD-2026-69574

Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...

CVE-2026-78603 Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting ...

CVE-2026-78603 Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting ...

EUVD-2026-69571

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting ...

CVE-2026-72641 Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...

CVE-2026-72641

An Incorrect Authorization (CWE-863) flaw in Kibana allows an authenticated user holding only Security Solution read access in a Kibana space to enumerate and modify the state of Entity Store maintainer tasks , silently disabling Entity Analytics maintenance for that space. The root cause is func...

CVE-Requests-1896609

CVE 请求 1896609 - feiskyer/mcp-kubernetes-server 执行摘要 本报告详细介绍了在 feiskyer/mcp-kubernetes-server 包中发现的两个严重安全漏洞。当部署该服务器时，它会暴露一个名为 kubectl 的 MCP 工具，旨在提供对 Kubernetes 集群的有限、安全访问。然而，不充分的输入验证允许两种不同的攻击向量： OS命令注入：攻击者可以通过使用 shell 元字符（例如 ,、;）链接命令来绕过命令验证，从而在运行 MCP 服务器的主机上执行任意 OS 命令...

CVE-2026-84306

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode with a used-code cache key derived from both the app authentication secret an...