178379 matches found
EUVD-2026-68888
Sulu: Media move/update authorization bypass IDOR...
CVE-2026-24061
Docker Telnet Auto-Login Lab A lightweight Docker lab for experimenting with Telnet protocol negotiation , explained in the CVE-2026-24061 exploit, which contains automatic username injection using the NEW-ENVIRON option. This project creates an isolated client–server environment to study how...
EUVD-2026-58725
CKAN MCP Server: MQA server allowlist bypass via unanchored regex isValidMqaServer...
EUVD-2026-56156
SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control...
android-hardware-attestation-demo
Android hardware attestation bypass — demo This repository accompanies a Quarkslab article on Android hardware Key Attestation and exists to illustrate it. It is a small, end-to-end proof of concept that shows a simple bypass: an analyst on a rooted phone defeats a backend's hardware attestation...
CVE-2025-60787
CVE-2025-60787 CVE-2025-60787 Poc - RCE - MotionEye = 0.43.1b4 Original link: https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter MotionEye RCE via Client-Side Validation Bypass Summary During security testing of a MotionEye instance running in Docker, it was observed that...
EUVD-2026-68141
qs array-limit bypass via bracket-key comma parsing...
GHSA-X5FP-WJ9C-MXMX qs array-limit bypass via bracket-key comma parsing
Summary qs v6.15.3 allows bracket-key input to bypass arrayLimit and throwOnLimitExceeded when comma: true. The input a=1,2,3,4 succeeds with arrayLimit: 3, while the equivalent plain-key input is rejected. Affected version tested: text qs v6.15.3 commit 18d085e919dae70c8f1b200ab99323058edab2c2...
CVE-2026-14663
A flaw was found in PostgreSQL pgcrypto. When using disabled ciphers, a user can recover cleartext data by observing faulty ciphertext. This issue arises because the application may accept encrypted data as input, leading to successful decryption even with an incorrect key. Consequently, the...
EUVD-2026-70053
Incomplete Cleanup CWE-459 in Elastic Cloud on Kubernetes ECK can lead to unauthorized access via Privilege Abuse CAPEC-122. Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read...
EasyAdmin custom-action dispatcher bypasses access_control on other routes
Summary EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute / MenuItem::linkToRoute, swaps the executed controller based on the routeName query parameter on the kernel.controller event. That swap happens after Symfony's security...
EUVD-2026-68802
EasyAdmin custom-action dispatcher bypasses accesscontrol on other routes...
CVE-2026-6145
CVE-2026-6145 — User Registration & Membership for WordPress: Unauthenticated Admin Approval Bypass Proof-of-concept exploit for CVE-2026-6145 , a missing authorization vulnerability in the User Registration & Membership plugin for WordPress ≤ 5.1.5 that allows unauthenticated attackers to bypass...
EUVD-2026-68800
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...
GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...
EUVD-2026-67077
NLTK: Downloader.download follows hardlinks and overwrites outside-root files...
NLTK: Downloader.download follows hardlinks and overwrites outside-root files
Summary NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink. Details - Vulnerability type:...
GHSA-F794-5JV7-7672 NLTK: Downloader.download follows hardlinks and overwrites outside-root files
Summary NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink. Details - Vulnerability type:...