CVE-2026-53561 Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

CVE-2026-53561 Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

fortinet-fortiweb-cve-2025-64446-58034

Scopri le vulnerabilità di Fortinet FortiWeb CVE-2025-64446, CVE-2025-58034 1. Panoramica Fortinet FortiWeb è un dispositivo Web Application Firewall WAF ampiamente implementato nei sistemi aziendali per proteggere le applicazioni web dalle minacce comuni. Poiché FortiWeb si trova spesso nello...

CVE-2026-75037

LACT (Linux AppContainer Tool), a Linux-based application container management tool, is vulnerable to an authentication bypass through its Polkit authorization mechanism. The root cause lies in the reliance on UnixProcessSubject / Peer PID for Polkit authentication, which can be exploited locally...

CVE-2026-75037 Polkit authentication bypass in LACT

Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566...

CVE-2026-75037 Polkit authentication bypass in LACT

Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566...

EUVD-2026-65390

Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566...

next-js-auth-bypass

Hello World - Next.js 12.2 Eine einfache Proof-of-Concept-Anwendung mit Next.js 12.2. 🚀 Schnellstart 1. Abhängigkeiten installieren root@kitploit: npm install 2. Entwicklungsserver starten root@kitploit: npm run dev Die Anwendung ist unter http://localhost:3000 verfügbar. 🛠️ Verfügbare Skripte...

EUVD-2026-65345

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

EUVD-2026-65329

The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically...

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators. The vulnerabilities, as disclosed by Patchstack, are...

CrushFTP-CVE-2024-4040-illdeed

CVE-2024-4040 — Exploit per il bypass dell'autenticazione di CrushFTP Questo repository contiene un proof-of-concept PoC stealthy in Python per CVE-2024-4040 , una vulnerabilità critica in CrushFTP v10 e versioni precedenti che consente a un attaccante di bypassare l'autenticazione utilizzando un...

CVE-2024-3408-dtale

CVE-2024-3408 - Bypass dell'autenticazione e RCE in D-Tale Ambiente di laboratorio riproducibile per CVE-2024-3408, una vulnerabilità di bypass dell'autenticazione ed esecuzione remota di codice in D-Tale. Vulnerabilità Le versioni di D-Tale fino alla 3.15.1 sono vulnerabili a causa di: 1...

CVE-2026-59769

FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, can operate the settings screen using that credentials to alter the identification number...

OPENSUSE-SU-2026:21645-1 Security update for trivy

This update for trivy fixes the following issue: - CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing vulnerabilities allow authentication bypass, authorization override, and log forgery bsc1276128. Changes for trivy: - Update to version 0.74.0: release:...

CVE-2023-49547

CVE-2023-49547 Customer Support System 1.0 - Bypass del Login tramite SQL Injection Descrizione : Customer Support System 1.0 è vulnerabile a SQL Injection. Una vulnerabilità di SQL injection in Customer Support System 1.0 consente a un attaccante remoto non autenticato di bypassare il processo d...

CVE-2025-2825-CrushFTP-AuthBypass

🚨 CVE-2025-2825 – CrushFTP Authentifizierungsumgehung 🔎 Überblick CVE-2025-2825 ist eine kritische Schwachstelle zur Authentifizierungsumgehung, die CrushFTP betrifft, einen weit verbreiteten sicheren Dateiübertragungsserver. Der Fehler ermöglicht es entfernten Angreifern, die...

Fortinet - Authentication Bypass

Fortinet FortiOS is vulnerable to an information disclosure via service-worker.js that could allow an attacker to access sensitive information.This vulnerability affects FortiOS and could potentially lead to unauthorized access to the system. id: CVE-2024-55591 info: name: Fortinet - Authenticati...

Zoho ManageEngine ServiceDesk Plus - Authentication Bypass

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. id: CVE-2021-37415 info: name: Zoho ManageEngine ServiceDesk Plus - Authentication Bypass author: daffainfo,jjcho severity: critical description: | Zoho...

Zoho ManageEngine Desktop Central - Remote Code Execution

Zoho ManageEngine Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. id: CVE-2021-44515 info: name: Zoho ManageEngine Desktop Central - Remote Code Execution author: Adam Crosser severity:...