CVE-2026-84200 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200

Kyverno versions v1.9.0 through v1.12.7 are affected by a policy exception handling flaw . When a policy in enforce mode is combined with two PolicyExceptions , the less restrictive exception takes precedence. An attacker can exploit this by crafting a resource name that matches the second except...

CVE-2026-83595

AVideo contains a Cross-Site Request Forgery (CSRF) vulnerability in the plugin/API/set.json.php component. The flaw allows attackers to craft GET requests that bypass CSRF protection, performing state-changing actions on a victim's session without user consent. Concretely, a victim can be naviga...

CVE-2026-83595 AVideo Cross-Site Request Forgery via plugin/API/set.json.php

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,...

patch-CVE-2026-11553

패치: CVE-2026-11553 취약점 세부 정보 CVE : CVE-2026-11553 제품 : VMware vCenter 설명 : 인증 우회 심각도 : 치명적 패치 상태: 배포됨 필드| 값 ---|--- 패치 날짜| 2026-04-28 상태| 배포됨 배포 대상| 프로덕션 검증자| SecOps 팀 참고 자료 NVD CISA KEV...

CVE-2026-77194 Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the...

CVE-2026-77194

The Simple Membership WordPress plugin (versions up to 4.8.0 , with a partial fix in 4.8.1) is affected by an unauthenticated Authentication Bypass that can lead to Administrator Account Takeover in WordPress Multisite environments. The root cause is improper identity verification during the publ...

EUVD-2026-69022

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the...

CVE-2024-21413-Microsoft-Outlook-Moniker-Link-Vulnerability

CVE-2024-21413 – Microsoft Outlook Moniker Link 취약점 개요 이 저장소는 SMB 인증을 통해 Windows NetNTLMv2 자격 증명을 유출하기 위해 Protected View를 우회하는 치명적인 Microsoft Outlook 취약점인 CVE-2024-21413Moniker Link 에 대한 실습 분석을 문서화한 것입니다. 심각도: 치명적CVSS 9.8 학습 목표 Moniker Link 이해하기 Outlook Protected View 작동 방식 배우기 CVE-2024-21413 분석하...

CVE-2026-80675

A flaw was found in libbpf, a library for working with eBPF extended Berkeley Packet Filter programs in the Linux kernel. This vulnerability occurs when the signed loader fails to ensure that metadata maps are exclusive during verification. A hostile host could exploit this by omitting exclusivit...

CVE-2026-80213

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...

CVE-2026-82660

A flaw was found in Nodemailer, a module for sending emails. The jsonTransport component, responsible for handling message data, does not correctly enforce security options designed to prevent unauthorized file and URL access. A remote attacker could exploit this by sending specially crafted...

cve-2023-22515-lab

cve-2023-22515-lab 시뮬레이션된 취약 환경을 사용하여 CVE-2023-22515 — Atlassian Confluence 인증 우회를 시연하는 실습형 보안 랩입니다...

CVE-2026-82659

A flaw was found in nodemailer. Authenticated attackers can bypass security flags by crafting raw messages with specific file paths or URLs. This allows them to read arbitrary files from the system or perform Server-Side Request Forgery SSRF, potentially leading to information disclosure or...

CVE-2026-81727

A flaw was found in NLTK. This vulnerability, a filesystem containment bypass, allows a local attacker with write access to a shared downloader directory to create special links hardlinks that point to files outside the intended installation area. When a package is extracted, these hardlinks can...

WP2Shell

WP2Shell - WordPress 事前認証 RCE エクスプロイト CVE-2026-63030 + CVE-2026-60137 バージョン: 4.0.0 作者: G0D150NE 📌 概要 WP2Shell は、WordPress の事前認証リモートコード実行（RCE）のためのフルチェーンエクスプロイトツールです。このツールは、2 つの重大な脆弱性を組み合わせています： CVE-2026-63030 - REST API バッチエンドポイントにおける SQL インジェクション CVE-2026-60137 - oEmbed キャッシュポイズニングによる認証バイパス...

CVE-2012-2122-Home-Lab

CVE-2012-2122 MySQL Authentication Bypass 홈 랩 이 랩은 CVE-2012-2122 - MySQL Authentication Bypass 취약점을 시연하는 예제입니다. MySQL 5.5.23 또는 그 이하 버전에서 비밀번호 값 비교 오류로 인해 발생합니다. 공격자가 잘못된 비밀번호를 여러 번 반복해서 보내면 MySQL은 의도치 않게 로그인을 허용할 수 있습니다. 기능 vulhub/mysql:5.5.23 기반 플래그를 자동으로 생성하는 entrypoint.sh 스크립트 포함 플래그는...

polkit-CVE-2021-3560_writeup

Try Hack Me - Polkit:CVE-2021-3560 작성자: Atharva Bordavekar 난이도: 정보 포인트: 32 취약점: CVE-2021-3560 먼저 polkit 버전을 확인하여 더 나은 통찰력을 얻을 것입니다. root@kitploit: apt list --installed | grep policykit-1 policykit-1/focal,now 0.105-26ubuntu1 amd64 installed,upgradable to: 0.105-26ubuntu1.1 저는 deepseek를 사용하여 polic...

BIT-GITLAB-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...