Dgraph <= 25.3.2 - Admin Token Disclosure

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...

CVE-2024-42327

CVE-2024-42327: Zabbix Эскалация привилегий - Удаленное выполнение кода Описание Этот Proof-of-Concept POC может быть использован для эксплуатации CVE-2024-42327 для получения токена аутентификации API администратора и создания элемента для получения обратной оболочки на Zabbix сервере 6.0.32rc1,...

CVE-2026-82329-JFrog-Artifactory-Auth-Bypass

artifactory.py ╔══════════════════════════════════════════════════════════╗ ║ artifactory · CVE-2026-82329 unauth admin takeover ║ ║ mitsec · https://x.com/ynsmroztas ║ ╚══════════════════════════════════════════════════════════╝ CVE-2026-82329 — JFrog Artifactory자체 호스팅 인증 없는 join-JWT → SERVICE...

CVE-2026-34990

CVE-2026-34990 — CUPS 로컬 권한 상승 cups2root, 하네스 제거판 CVSS 3.x : 8.4 HIGH 대략 — 확인 필요 CWE : CWE-287 부적절한 인증 + CWE-269 부적절한 권한 관리 Fix : CUPS 2.4.17+ Affects : cupsd가 root로 실행되고 631 포트가 로컬에서 접근 가능한 CUPS ≤ 2.4.16 root cupsd에 대한 로컬 권한 상승. 악성 로컬 서버를 향해 IPP 클라이언트 로 동작하도록 유도되면, cupsd는 401 WWW-Authenticate:...

CVE-2024-27198_Lab

CVE-2024-27198Lab Vulnerability Research & Purple Team Demonstration Lab for JetBrains TeamCity Authentication Bypass CVE-2024-27198 Table of Contents About The Project CVE Details Built With Threat Intelligence & OSINT Real-World Impact & Exploitation Why this CVE is Critical Getting Started...

CVE-2026-20896

Код концептуального доказательства CVE-2026-20896 Этот скрипт автоматизирует эксплуатацию ошибки логики в проверке путей API Gitea, позволяя принудить сервер выдать действительный административный токен с помощью атаки с обходом каталога Directory Traversal в заголовке авторизации. !/usr/bin/env...

Exploit for Improper Authentication in Jfrog Artifactory

CVE‑2026‑82329 – JFrog Artifactory Auth B...

CVE-2026-86754 Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

CVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

CVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

EUVD-2026-74853

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

CVE-2026-80172

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions contain an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated remote attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens , since there is no nonce valida...

Exploit for Improper Authentication in Jfrog Artifactory

CVE-2026-82329-JFrog-Artifactory- CVE-2026-82329 — JFrog Arti...

SUSE CVE-2026-40173

Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, exposing the full process command line...

Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure

Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-82329 CVSS score: 9.8, a case of authentication bypass that could lead to administrative access in...

Exploit for CVE-2026-82329

CVE-2026-82329 — JFrog Artifactory unauthenticated auth bypass...

CVE-2026-82882

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

EUVD-2026-65447

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-79667 Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

Cross-site Scripting (XSS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the addJs and addCss methods in the Twig sandbox allowlist. An attacker can execute arbitrary scripts in the...