CVE-2026-102364

The mall4j framework (through version 4.0 ) contains an improper authentication vulnerability because it fails to validate the sysType field in sa-token sessions. This flaw allows storefront customers to authenticate as back-office users by reusing their own session tokens. An attacker who regist...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-97536

A flaw was found in the qla2xxx driver within the Linux kernel. A local user with administrative privileges could trigger a Denial of Service DoS or cause memory corruption during device or queue teardown. This issue occurs because background response queue tasks are not properly canceled before...

Exploit for CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x Authenticated RCE ⚠️...

CVE-2026-48611-phpBB

CVE-2026-48611-phpBB 绕过身份验证 简单的绕过身份验证PoC，如果想通过浏览器访问，别忘了根据浏览器显示的User-Agent更改脚本中的 USERAGENT 变量，否则无法正常工作。使用Cookie编辑器替换 sid和 u的值。 影响版本：phpBB 3.3.16及以下 + 4.0.0-a2 phpbb python3 exploit.py https://localhost:8000 joushk + Target: https://localhost:8000 + Target username: joushk + User-Agent: Mozilla/5.0...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

GO-2026-6540 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition in github.com/lucasdillmann/nginx-ignition

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition in github.com/lucasdillmann/nginx-ignition. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

CVE-2026-88808

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-88808 Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-88808 Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-88808

The Fleet agent in SUSE Rancher Fleet contains a vulnerability where it writes resources to downstream clusters using its own cluster-admin credentials instead of the specific ServiceAccount pinned to the deployment. This flaw impacts multi-tenancy environments where different teams share downstr...

EUVD-2026-88335

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-88808 Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2020-13945-EXPLOIT

CVE-2020-13945 - Apache APISIX リモートコード実行（RCE） このリポジトリには、Apache APISIX の脆弱性に対する概念実証（PoC）エクスプロイトが含まれています。この脆弱性は、Admin API が有効でアクセス IP 制限ルールが削除されている場合に発生し、デフォルトトークンを使用して APISIX の管理データにアクセスできるようになります。これはバージョン 1.2、1.3、1.4、および 1.5 に影響します。 目次 概要 影響を受けるバージョン セットアップ 使用方法 対策 免責事項 概要 Apache APISIX...

WordPress Malcure Malware Shield — Removal, Repair, Monitor plugin < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion vulnerability

Multisite Subsite Admin+ Arbitrary File Write and Deletion vulnerability discovered by Charles Vosburgh in WordPress Plugin Malcure Malware Scanner versions 19.9.7...

EUVD-2026-88045

A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php of the component Admin Settings Endpoint. Performing a manipulation of the argument general.settings.footer.labe...

EUVD-2026-88047

A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be...

EUVD-2026-88049

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...