EUVD-2026-67798

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2026-82267

Komodo (through version 2.3.2) contains a logic flaw in the /execute and /execute/{variant} API handlers, where internal resource identifiers are disclosed and audit log entries are written before permission checks are evaluated. Authenticated users can exploit this by guessing resource names to ...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2024-10793

CVE-2024-10793 PoC Fügen Sie diese Zeilen in Ihre hosts-Datei ein: root@kitploit: 127.0.0.1 goodcms.lab 127.0.0.1 attacker.com Starten Sie Wordpress mit Docker: root@kitploit: $ sudo systemctl start docker $ sudo docker-compose up -d Öffnen Sie http://goodcms.lab:2121 und führen Sie die...

cve-2026-32699-facturascripts-nick-bypass

CVE-2026-32699 - FacturaScripts Parametro Nick di EditUser Controllo di Accesso Rotto Descrizione Riepilogo L'applicazione non riesce a validare il parametro nick durante una richiesta POST al controller EditUser. Sebbene l'interfaccia utente impedisca la modifica di questo campo, un utente può...

CVE-2026-3494_Verfication

CVE-2026-3494 – MariaDB serveraudit Logging-Verifizierungs-PoC Dieses Projekt bietet eine spezialisierte Umgebung zur Verifizierung und Analyse eines potenziellen Audit-Logging-Bypasses im MariaDB-serveraudit-Plugin, wenn bestimmte Inline-Kommentare , -- innerhalb von SQL-Abfragen verwendet werde...

DFIR-O365RC

Indice: 1. Descrizione del modulo 2. Installazione e prerequisiti 1. Usando Docker 2. Installazione manuale 3. Gestione dell'applicazione DFIR-O365RC 1. Creazione dell'applicazione 2. Aggiornamento dell'applicazione 3. Rimozione dell'applicazione 4. Requisiti di autorizzazione e licenza 5. Funzio...

ALFA

ALFA Automatisierte forensische Analyse von Audit-Logs für Google Workspace Copyright c 2026 Invictus Incident Response Ursprüngliche Autoren Greg Charitonos & BertJanCyber, gepflegt von Invictus Incident Response Bevor Sie beginnen Ein Hinweis zu unterstützten Betriebssystemen: ALFA wird auf...

Elkeid

Elkeid - Piattaforma di protezione dei carichi di lavoro cloud di Bytedance English | 简体中文 Elkeid è una soluzione open source che soddisfa i requisiti di sicurezza di vari carichi di lavoro come host, container, K8s e serverless. Deriva dalle best practice interne di ByteDance. Con lo sviluppo de...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093269)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093269 advisory. Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Audit Log. Supported versions that are affected are 5.7.26 and prior and 8.0.16 and...

Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)

The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.14.6. It is, therefore, affected by a log injection vulnerability: - The Basic authentication username is decoded before credential validation and passed to the access logger without neutralizing control characters. A...

CVE-2026-44256

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...

CVE-2026-44256

Wazuh (open-source threat prevention, detection, and response platform) is vulnerable to CRLF log injection in its API access logger. In versions 4.4.0 through 4.14.6 and 5.0.0-beta2 , the file api/api/middlewares.py decodes the Basic-authentication username before credential validation and passe...

EUVD-2026-62575

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...

CVE-2026-44256 Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...

Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...

GHSA-4H97-P9WQ-CHQJ Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...

CVE-2026-71322 Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...

EUVD-2026-61158

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...

CVE-2026-71322

Lemur (Netflix's TLS certificate management platform) prior to 1.9.3 contains an authorization bypass in the CertificateExport handler (lemur/certificates/views.py). The CertificatePermission ownership check is structurally nested inside an if plugin.requires_key: branch, so any export plugin dec...