CVE-2026-91922

Steedos Platform through version 3.0.15-beta.47 is affected by a reflected cross-site scripting (XSS) vulnerability in the anonymous /api/page/render endpoint. The root cause is the failure to properly escape query parameters within inline script elements. An attacker can craft malicious links co...

CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...

watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553

CVE-2025-40552 y CVE-2025-40553 Cadena RCE Pre-Auth en SolarWinds Web Help Desk Herramienta generadora de artefactos de detección para la cadena RCE Pre-Auth en SolarWinds Web Help Desk Descripción Este generador de artefactos de detección verifica si una instancia de SolarWinds Web Help Desk es...

CVE-2026-52824

Kimai is an open-source time tracking application. Prior to version 2.58.0 , the official Docker image hardcodes APP_SECRET=change_this_to_something_unique in the Dockerfile, and the entrypoint script neither replaces nor validates this value before Symfony uses it as kernel.secret. An unauthenti...

CVE-2026-39987-marimo-rce

CVE-2026-39987 - Marimo 预认证远程代码执行 在 Marimo 中通过 WebSocket 终端实现未认证远程代码执行 📌 概述 CVE-2026-39987 是一个影响 Marimo 0.23.0 之前版本的严重预认证远程代码执行 漏洞。/terminal/ws WebSocket 端点完全绕过认证，允许任何未认证的攻击者以 Marimo 进程的权限（在 Docker 环境中通常为 root ）获取完整的交互式 PTY shell。 🛠️ 漏洞详情 CVE ID : CVE-2026-39987 受影响产品 : Marimo（响应式 Python 笔记本） 受影响版...

CVE-2026-36826

CVE-2026-36826: Inyección SQL en genesisQL = 1.1.1 Resumen genesisQL 1.1.1 es vulnerable a inyección SQL en la función checkPassword. Los campos username y password proporcionados por el usuario se interpolan directamente en la cadena de consulta SQL sin parametrización, lo que permite inyección...

CVE-2026-45829

🚨 CVE-2026-45829 - ChromaDB 预认证远程代码执行 ChromaDB 向量数据库中的严重远程代码执行漏洞 📌 概述 CVE-2026-45829 是 ChromaDB （一款流行的开源 AI 向量数据库）中的一个严重预认证远程代码执行 漏洞。 未经身份验证的攻击者可以利用 ChromaDB 处理嵌入函数配置的方式，在服务器上实现完全远程代码执行 。 关键信息 项目| 详情 ---|--- CVE ID| CVE-2026-45829 严重性| 严重 CVSS 9.8 受影响组件| 嵌入函数处理器 攻击向量| 未认证 HTTP 请求 影响| 远程代码执行 RCE...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

Important: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

CVE-2026-45051 OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from the configured userAttribute through loadAuthenticators without an ObjectInputFilter. Exploitation requires the WebAuthn flow to be...

CVE-2026-45051 OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from the configured userAttribute through loadAuthenticators without an ObjectInputFilter. Exploitation requires the WebAuthn flow to be...

CVE-2026-45051 OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from the configured userAttribute through loadAuthenticators without an ObjectInputFilter. Exploitation requires the WebAuthn flow to be...

CVE-2026-45052 OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests to write persistent entries through SOAPReceiver and DiscoveryService into a user's Liberty Discovery store and the shared root-realm...

CVE-2026-45052 OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests to write persistent entries through SOAPReceiver and DiscoveryService into a user's Liberty Discovery store and the shared root-realm...

BIT-RCLONE-2026-88017 rclone: FTP cross-session auth-proxy backend confusion

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

wp2shell-detect

wp2shell-detect Detector de caja negra, no intrusivo , para wp2shell — la cadena de RCE de preautenticación en el núcleo de WordPress divulgada el 2026-07-17: CVE-2026-63030 — confusión de rutas en el endpoint REST batch /wp-json/batch/v1: una subpetición cuya ruta falla en wpparseurl termina en ...

CVE-2026-10520

🎯 CVE-2026-10520 与 CVE-2026-10523 - Ivanti Sentry 无需认证的远程代码执行 + 身份验证绕过 作者： Ashraf Zaryouh "0xBlackash" 📌 概述 影响 Ivanti Sentry （原 MobileIron Sentry）的两个严重漏洞： CVE-2026-10520 → CVSS 10.0 - 无需认证的操作系统命令注入（以 root 权限执行 RCE） CVE-2026-10523 → CVSS 9.9 - 身份验证绕过 这些漏洞允许未认证的攻击者完全攻陷系统。 ✨ 功能特性 ✅ 简洁快速的 PoC ✅...

vulnerable-nextjs-14-CVE-2025-29927

CVE-2025-29927 认证绕过复现 该仓库是对 next 包中 CVE-2025-29927 漏洞的复现 如何复现 1. 按照以下步骤克隆并运行 Next.js 应用程序 2. 测试授权是否拒绝访问 /api/hello 端点 root@kitploit: $ curl http://localhost:3000/api/hello "error":"Unauthorized"% 3. 测试提供令牌时授权是否正常 root@kitploit: $ curl -H "Authorization: my-jwt-token-here"...

wp2shell

wp2shell-check Comprobador no intrusivo para CVE-2026-63030 / CVE-2026-60137 "wp2shell", una cadena de ejecución remota de código RCE de preautenticación en el núcleo de WordPress confusión de la ruta batch de la API REST → inyección SQL → RCE. Versiones afectadas: WordPress 6.9.0–6.9.4,...