CVE-2024-42327

CVE-2024-42327: Zabbix 権限昇格 - RCE 説明 この Proof-of-Concept POC は、CVE-2024-42327 を悪用して管理者API認証トークンを漏洩させ、アイテムを作成して Zabbix サーバー 6.0.32rc1, 6.4.17rc1, 7.0.1rc1 上でリバースシェルを獲得するために使用できます。 Zabbix フロントエンド上で、デフォルトの User ロール、または API アクセスを提供するその他のロールを持つ非管理者ユーザーアカウントがこの脆弱性を悪用できます。 CUser クラスの addRelatedObjects 関...

Dgraph <= 25.3.2 - Admin Token Disclosure

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...

CVE-2026-82329-JFrog-Artifactory-Auth-Bypass

artifactory.py root@kitploit: ╔══════════════════════════════════════════════════════════╗ ║ artifactory · CVE-2026-82329 未授权管理员接管 ║ ║ mitsec · https://x.com/ynsmroztas ║ ╚══════════════════════════════════════════════════════════╝ CVE-2026-82329 — JFrog Artifactory（自托管）未授权 join-JWT → SERVICE adm...

CVE-2024-27198_Lab

CVE-2024-27198Lab Vulnerability Research & Purple Team Demonstration Lab for JetBrains TeamCity Authentication Bypass CVE-2024-27198 Table of Contents About The Project CVE Details Built With Threat Intelligence & OSINT Real-World Impact & Exploitation Why this CVE is Critical Getting Started...

CVE-2026-20896

概念実証コード CVE-2026-20896 このスクリプトは、Gitea API のルート検証におけるロジックの欠陥を自動的に悪用し、認証ヘッダー内のディレクトリトラバーサル攻撃を通じてサーバーに有効な管理トークンを強制的に付与させます。 root@kitploit: !/usr/bin/env python3 PoC: Gitea 認証バイパス CVE-2026-20896 管理された環境および認定監査 CTF 専用 import requests import sys import argparse def exponebypasstargetip, username: print...

CVE-2026-86754 Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

CVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

CVE-2026-80172

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions contain an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated remote attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens , since there is no nonce valida...

EUVD-2026-74853

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

Exploit for Improper Authentication in Jfrog Artifactory

CVE-2026-82329-JFrog-Artifactory- CVE-2026-82329 — JFrog Arti...

Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure

Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-82329 CVSS score: 9.8, a case of authentication bypass that could lead to administrative access in...

Exploit for CVE-2026-82329

CVE-2026-82329 — JFrog Artifactory unauthenticated auth bypass...

CVE-2026-82882

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

EUVD-2026-65447

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-48162

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...

CVE-2026-48162 Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...

EUVD-2026-62556

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...

CVE-2026-15315

Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session token...

PT-2026-78230

Name of the Vulnerable Software and Affected Versions Tapo C200 version v5 Description An improper authentication issue exists within the login authentication verification module. An attacker on the local network can exploit weaknesses in the validation of the challenge parameter to bypass...

CVE-2026-18676

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...