CVE-2021-3560

استغلال تجاوز المصادقة عبر D-Bus في Polkit توجد ثغرة أمنية في خدمة نظام polkit يمكن استغلالها من قبل مهاجم محلي غير مميز لتنفيذ عمليات مميزة. لاستغلال الثغرة، يقوم المهاجم باستدعاء طريقة عبر D-Bus ثم يقتل عملية العميل. قد يؤدي هذا في بعض الأحيان إلى إكمال العملية دون الخضوع لجميع المصادقة اللازمة...

CVE-2019-12476

ADSelfService-Plus-PoC CVE-2019-12476 ADSelfService Plus الإصدار 4.3.3 إثبات مفهوم لتجاوز المصادقة على ويندوز 10. يؤثر على جميع إصدارات ويندوز فيديو إثبات المفهوم خطوات إعادة الإنتاج 1. افصل من شبكة مؤسستك 2. اتصل بنقطة اتصال خاصة بك 3. انقر على إعادة تعيين كلمة المرور؛ يجب أن يعرض متصفح العميل...

CVE-2025-43921

CVE-2025-43921: إنشاء قوائم بريدية غير مصرح به في GNU Mailman 2.1.39 حزمة cPanel/WHM اكتشف بواسطة: Firudin Davudzada & Musazada Aydan تاريخ الإفصاح: أبريل 2025 معرف CVE: CVE-2025-43921 الخطورة: 5.3 متوسطة CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N نوع الهجوم: عن بُعد البرنامج المتأثر: GNU Mailm...

cloudflare-bypass-2026

Outil de contournement Cloudflare 2026 Un ensemble d'outils multi-stratégies pour la recherche et les tests autorisés des flux Cloudflare Turnstile / Challenge sur macOS, Windows et Linux. Table des matières...

CVE-2026-82744

Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...

CVE-2026-82746

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...

CVE-2026-82740

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mapping only...

CVE-2026-82736

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...

CVE-2026-82741

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :mapwithtag, bypassing that member's validation and any tag-based authorization. For a union with storage: :mapwithtag, each...

CVE-2026-82734

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value. Ash.Type.Decimal cast input through Ecto's decimal cast in castinput/2 and...

CVE-2026-82748

An incorrect authorization flaw in the Elixir library ash-project ash (versions 3.5.13 through before 3.32.2 ) affects Ash.Actions.Aggregate . Aggregates are authorized under a group's read_action, but the query-building code selected the action as opts[:action] || read_action || primary_read. Wh...

EUVD-2026-68951

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...

CVE-2026-82746

CVE-2026-82746 is a missing authorization flaw in the ash-project/ash Elixir framework affecting versions 3.29.0 through 3.32.1 . The Ash.update_many/4 function, when using the atomic strategy, executed a single data-layer statement (e.g., a SQL MERGE) that bypassed resource policies even with au...

RCE-CVE-2026-10520-CVE-2026-10523

CVE-2026-10520 et CVE-2026-10523 Un générateur d'artefacts de détection pour le contournement de l'authentification et l'exécution de code à distance Ivanti Sentry. Voir notre article de blog pour les détails techniques. Détection en action root@kitploit: $ python3 CVE-2026-10523.py --url...

EUVD-2026-68946

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :mapwithtag, bypassing that member's validation and any tag-based authorization. For a union with storage: :mapwithtag, each...

CVE-2026-82741 Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :mapwithtag, bypassing that member's validation and any tag-based authorization. For a union with storage: :mapwithtag, each...

CVE-2026-82741 Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :mapwithtag, bypassing that member's validation and any tag-based authorization. For a union with storage: :mapwithtag, each...

CVE-2026-82741

CVE-2026-82741 affects the ash-project ash Elixir framework (versions 2.14.18 through before 3.32.2 ). The vulnerability is in Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex), which did not force the configured tag when writing values with storage: :map_with_tag. An attacker can submit a ...

CVE-2026-82740 Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mapping only...

EUVD-2026-68945

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mapping only...