EUVD-2026-68814

Smarty: SSRF via redirect bypass of trusteduri using fetch...

Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

When a Security policy is active, fetch validates the requested remote URL against the trusteduri allowlist via Security::isTrustedUri. For non-http:// schemes e.g. https:// the resource was then read with filegetcontents, which follows HTTP redirects by default. Because isTrustedUri only validat...

CVE-2024-0204

CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive This repository contains a proof-of-concept exploit for the authentication bypass vulnerability CVE-2024-0204 discovered in Fortra's GoAnywhere MFT product. The vulnerability allows an unauthenticated attacker to create an...

[SECURITY] [DLA 4766-1] cyrus-imapd security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4766-1 [email protected] https://www.debian.org/lts/security/ Xavier Guimard September 01, 2026 https://wiki.debian.org/LTS -...

CVE-2026-49329

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...

CVE-2018-10933_ssh

CVE-2018-10933 لاختبار هذا الكود: احصل على النسخة المصابة من libssh من الصفحة الرئيسية: https://www.libssh.org/files/0.7/libssh-0.7.4.tar.xz قم بفك الضغط والبناء، ثم انتقل إلى دليل الأمثلة، هناك خادم sshd بسيط يستخدم libssh اسمه: samplesshd-cb شغّل هذا الخادم sshd البسيط بالأمر: $ samplesshd-cb...

CVE-2026-83608

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. A remote attacker can exploit this vulnerability by providing a specially crafted DocumentType.name containing characters like or whitespace. This bypasses the requireWellFormed validation, allowing the injection of...

CVE-2026-43914-PoC

CVE-2026-43914 — Vaultwarden 이메일 2FA 무차별 대입brute-force 보호 우회 CVE-2026-43914 에 대한 개념 증명PoC: 이메일 2FA 가 활성화된 경우, Vaultwarden의 로그인 무차별 대입 보호는 인증되지 않은 POST /api/two-factor/send-email-login 엔드포인트를 통해 완전히 우회될 수 있으며, 이 엔드포인트는 무제한 마스터 비밀번호 오라클 역할을 합니다. 영향을 받는 버전: Vaultwarden 1.35.4 중요성 Vaultwarden은 가장 널리...

POC-CVE-2026-18963

CVE-2026-18963 — Keycloak 비밀번호 찾기 Forgot-Password 흐름 인증 우회 PoC CVE-2026-18963 에 대한 Proof of Concept입니다. 이는 Keycloak의 "비밀번호 찾기" / 자격 증명 선택 흐름에서 발견된 결함으로, 공격자가 필요한 신원 확인예: 유효한 OTP/2차 인증을 제대로 완료하지 않고도 UPDATEPASSWORD 단계에 도달하여 대상 계정의 비밀번호를 재설정할 수 있게 합니다. 이 스크립트는 브라우저/Selenium 없이 순수 HTTP만으로 흐름을 진행하며, 다...

CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account Takeover Unauthenticated account takeover in Keycloak's reset-credentials flow. An attacker who knows only a username/email can reset any user's password — including admins — without ever receiving the verification email. ⚠️ Disclaimer —...

CVE-2026-49329

A flaw in openshift/oauth-server allows an unauthenticated attacker to trigger a quadratic-time denial of service by sending a crafted Accept-Language header using '_' separators to the OAuth login and error page endpoints. The root cause is a bypass of the CVE-2022-32149 mitigation : the upstrea...

CVE-2026-49329 Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...

CVE-2026-39363

CVE-2026-39363 — PoC de lecture arbitraire de fichiers sur Vite Dev Server PoC directement exécutable pour GHSA-p9ff-h696-f583. Il contourne la restriction server.fs.allow de la couche HTTP en appelant fetchModule via le WebSocket HMR sans authentification, ce qui permet de lire des fichiers...

CVE-2026-84267 Gvfs: sftp: uninitialized heap disclosure in read_string()

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...

EUVD-2026-69296

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...

CVE-2026-84267 Gvfs: sftp: uninitialized heap disclosure in read_string()

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...

CVE-2026-84207 Heym before 0.0.98 SSRF via WebSocket endpoints

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket...

CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

CVE-2026-84206

Snipe-IT before 8.7.0 contains an authorization bypass in the bulk asset restore endpoint , which is gated on the assets.edit permission instead of the intended assets.delete permission. This allows authenticated users with only edit rights to restore soft-deleted assets by posting asset identifi...

EUVD-2026-69295

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket...