wp2shell-scan

wp2shell-scan Detectar y limpiar el compromisowp2shell CVE‑2026‑63030 en uno o varios sitios WordPress. wp2shell es la vulnerabilidad de ejecución remota de código sin autenticación previa corregida en WordPress 7.0.2 / 6.9.5 / 6.8.6 2026‑07‑17. Apareció un PoC público en un día y la explotación...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI to RCE Exploit Pre-Auth Path Traversal via 'tab' Parameter → Local File Inclusion Overview CVE-2026-9290 is a high-severity CVSS 7.5 unauthenticated Local File Inclusion vulnerability in the WP User Manager – User Profile Builder & Membership WordPress plugin ≤...

PT-2026-92476

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged ' ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16...

PT-2026-93134

Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

Security Vulnerabilities fixed in Thunderbird 140.16 — Mozilla

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. A maliciously constructed IMAP line could cause an out-of-bounds buffer read. A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP respon...

CVE-2026-91143

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...

CVE-2026-0073

Exploit de omisión de autenticación TLS de ADB CVE-2026-0073 Un escáner de red automatizado y herramienta de explotación para CVE-2026-0073 , una vulnerabilidad en el demonio Android Debug Bridge adbd que permite la ejecución remota de código RCE no autenticada y acceso interactivo a shell a trav...

CVE-2026-77191 All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplicant policy enforcement. An authenticated supplicant on an

An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window milliseconds to seconds between the completion of the authentication phase and the full enforcement of its assigned ACL...

CVE-2025-47227

CVE-2025-47227 Exploit for CVE-2025-47227 - ScriptCase Password Reset Pre-Auth CVE-2025-47227 is a pre-auth authentication bypass CVSS 9.8 in the ScriptCase Production Environment ≤ 9.12.006. The login.php endpoint allows resetting the administrator password without a token, email validation, or...

CVE-2026-30784-rustdesk-poc

CVE-2026-30784-rustdesk-poc CVE-2026-30784: RustDesk hbbs Traffic Amplification PoC & PCAP Analysis Key Findings Key Finding: Enforcing key-based authentication -k does not prevent this amplification attack, because the amplification response is triggered during the unauthenticated initial...

CVE-2026-12763 Langflow is vulnerable to authentication bypass and insufficient session expiration

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component...

CVE-2026-19816

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

CVE-2023-46747

CVE-2023-46747 Un script de explotación desarrollado para explotar el CVE-2023-46747 que permite la ejecución remota de código sin autenticación en productos f5-BIG-IP. Este es un script destinado a explotar la ejecución remota de código en productos f5-BIG-IP vulnerables. Instalación:...

rsync: rsync: Authorization bypass via `auth users` directive parsing

An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain...

rsync: rsync: Authorization bypass via `auth users` directive parsing

An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain...

watchTowr-vs-SmarterMail-CVE-2025-52691

CVE-2025-52691 SmarterMail Pre-Auth RCE SmarterMail Pre-Auth RCE 1day Detection Artifact Generator Tool Detección en acción El Generador de Artefactos de Detección intenta escribir el archivo .aspx en el directorio C:\Program Files x86\SmarterTools\SmarterMail\Service\AppData builds 94xx o en el...

CVE-2026-59178

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-20253

CVE-2026-20253 — Laboratorio de RCE sin autenticación previa en Splunk Enterprise Creación y truncado arbitrario de archivos sin autenticación a través del sidecar de PostgreSQL CVSS 9.8 · Crítico · CWE-306 · Explotado activamente CISA KEV ⚠️ Aviso legal Este repositorio está destinado...

CVE-2026-73494

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...