7515 matches found
CVE-2026-96455
The Reachy Mini daemon is vulnerable to unauthenticated remote code execution due to a missing authentication check on its app installation endpoint (POST /apps/install ). An attacker on the same local network can exploit this by providing a body that names a public Hugging Face Space. The daemon...
EUVD-2026-85185
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...
CVE-2026-96455 Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...
codecentric__spring-boot-admin_CVE-2022-46166_2-6-9
Spring Boot Admin de codecentric Este proyecto comunitario proporciona una interfaz de administración para aplicaciones Spring Boot ®. La monitorización de aplicaciones Python está disponible usando Pyctuator. Spring Boot Admin proporciona las siguientes funcionalidades para las aplicaciones...
cve-2024-8069-exp-Citrix-Virtual-Apps-XEN
CVE-2024-8068 and CVE-2024-8069 Citrix 虚拟应用和桌面 XEN 未认证远程代码执行漏洞 查看我们的博客文章了解详细的技术信息。 https://github.com/user-attachments/assets/563fd110-5321-49f7-8dc3-48eb0a53e0f9 漏洞利用演示 root@kitploit: python exploit-citrix-xen.py --target 192.168.1.120 --port 80 --cmd "whoami" CVE-xxxx-xxxxx.py Citrix 虚拟应用和桌面...
mcp-attack-detection-sentinel
Detección de ataques MCP — Laboratorio de investigación de Sentinel Investigación de detección de Sentinel para patrones de ataque de MCP Protocolo de Contexto de Modelo : acceso de identidad inusual tras un evento relacionado con MCP, mutación de la definición de herramientas, acceso entre...
NoFrak
NoFrak NoFrak es una implementación de Prueba de Concepto para Android diseñada para prevenir los ataques de fracking descritos en "Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks", por Martin Georgiev, Suman Jana y Vitaly Shmatikov. NDSS 2014. Cordova...
CVE-2026-94040: Server-Side Request Forgery (SSRF)
A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/app/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may b...
CVE-2025-13796-PoC
CVE-2025-13796-PoC deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery PoC : root@kitploit: curl --path-as-is -i -s -k -X $'GET' \ -H $'Host: x.x.x.x' \ $'http://x.x.x.x/live/invoke/website/loaders/analyticsScript.ts?url=file:///etc/passwd'...
atomicvulns
⚠️ Intentionally vulnerable. Run locally only. Never expose to the internet or a shared network. Read this in other languages: Português Brasil What is atomicvulns?...
web-inf-path-trav
WebXMLExp.py Herramienta para ayudar en la explotación de vulnerabilidades de path traversal en aplicaciones web Java. Esta herramienta se referencia en el informe técnico de Invicti Security Explotación de vulnerabilidades de path traversal en aplicaciones web Java. Instalación Para esta...
Azure-App-Tools
Azure-App-Tools Colección de herramientas para usar con aplicaciones de Azure. https://azure.microsoft.com/en-us/get-started/apps/ Requisitos previos Módulo de Azure PowerShell https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-3.8.0 Ejemplos: Códigos de dispositivo dinámic...
vibe-coding-security
Vibe Coding Security Antes de que tuitees tu lanzamiento, ejecuta estas 69 comprobaciones. Se corresponden con los patrones exactos detrás del CVE de RLS de Lovable CVE-2025-48757, 170+ apps, 2025, la filtración de Moltbook 1,5 millones de tokens de API, febrero de 2026 y la brecha de la platafor...
CLEANSTART-2026-AL62330 Security fix for CVE-2025-11966 applied in: apicurio-registry 3.1.7-r6, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.4.7-r5, keycloak 26.5.7-r4, kogito-apps 10.1.0-r0
CVE-2025-11966 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-BG00340 Security fix for CVE-2025-27817 applied in: kogito-apps 10.1.0-r0
Security vulnerability affects the kogito-apps package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-XL50889 Security fix for CVE-2025-49146 applied in: kogito-apps 10.1.0-r0
Security vulnerability affects the kogito-apps package. This issue is resolved in later releases. See references for vulnerability details...
EUVD-2026-82592
Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-82589
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-77164: Server-Side Request Forgery (SSRF)
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...
