210854 matches found
EUVD-2026-110640
The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qodemembershipcheckfacebookuser AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within t...
CVE-2026-92885 Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login
The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qodemembershipcheckfacebookuser AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within t...
CyberSecVulnerabilitiesDemo
CyberSec Vulnerabilities Demo Cybersecurity demonstrations fo...
hunt-for-cve-2018-10933
Hunt for and Exploit the libSSH Authentication Bypass CVE-2018-10933 Practical Guide explaining how to find hosts vulnerable to the libSSH Authentication Bypass CVE-2018-10933 and how to exploit them to gain shell access. Please refer to the following blog post for instructions:...
WordPress Qode Membership plugin <= 2.0.6.2 - Authentication Bypass vulnerability
Authentication Bypass vulnerability discovered by 0xwackydawg in WordPress Plugin Qode Membership versions = 2.0.6.2...
dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network...
Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
The Computer Emergency Response Team of Ukraine CERT-UA has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating...
crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...
crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...
Exploit for Improper Authentication in Hikvision Ds-2Cd2032-I_Firmware
CVE-2017-7921 — Hikvision IP Camera / DVR / NVR Improper Au...
Microsoft Exchange - Authentication Bypass
Microsoft Exchange Server Information Disclosure Vulnerability. This vulnerability enables an attacker to bypass authentication and gain access to the Exchange Server's internal. id: CVE-2021-33766 info: name: Microsoft Exchange - Authentication Bypass author: daffainfo severity: high description...
CLEANSTART-2026-JX43072 max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity
Security vulnerability affects the wildfly package. The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity...
CLEANSTART-2026-WG84677 Improper authentication in ASP
Security vulnerability affects the azure-functions-host package. Improper authentication in ASP...
CLEANSTART-2026-OJ95244 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...
CLEANSTART-2026-GQ21179 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes
Security vulnerability affects the trino package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...
EUVD-2026-110524
OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data,...
EUVD-2026-110538
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/deleteadmin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has bee...
EUVD-2026-110495
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMYSECRET fallback key. When KENERSECRETKEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to...
CVE-2026-116817
OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data,...
CVE-2026-116604
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/deleteadmin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has bee...