vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

SummaryCurrent vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through mediaiokwargs.video.videobackend, but engine GPU memory reservation is computed only from static startup configuration and VLLMVIDEOLOADERBACKEND. If the server starts with the default...

djust has an authorization bypass on the WebSocket/SSE mount path

ImpactThe live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @methoddecoratorloginrequired, name="dispatch", and custom dispatch guards — an...

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this...

BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints

A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function asyncprecallhook of the file enterprise/enterprisehooks/bannedkeywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack ma...

CVE-2026-24306

Azure Front Door Privilege Escalation – CVE-2026-24306 PoC For authorized red team / research use only. Author not responsible for misuse. Vulnerability allows: Arbitrary routing rule injection Backend pool / origin group modification WAF policy attachment / override Custom domain takeover on...

By-Poloss..-..CVE-2026-19125

CVE-2026-19125 — EthPress login; // wpsetauthcookie Execution continues into the login block, Address::login resolves the attacker-supplied wallet address to its owning WordPress user, and wpsetauthcookie authenticates that user. The response is "success":true,"data":"message":"Logged in". 2...

CVE-2023-31446-Remote-Code-Execution

CVE-2023-31446-Remote-Code-Execution Repository contains description for CVE-2023-31446 discovered by Dodge Industrial Team for Dodge OPTIFY platfrom. CVE ID: CVE-2023-31446 Vendor: Cassia Networks Product: Cassia Gateway Firmware Version: http:///bypass/config?type=sqs&keyId=&key=&queueUrl= Base...

EUVD-2026-57810

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block...

CVE-2026-102674

A flaw was found in Electron. Windows opened from a sandboxed top-level document do not inherit that document's active sandbox restrictions. An attacker capable of delivering untrusted content to a sandboxed document can open a popup window that runs with the application's full origin rather than...

CVE-2026-39987-lab-or-marimo-cve-lab

CVE-2026-39987 Lab Guide Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass An educational Docker lab for understanding, reproducing, and patching this critical vulnerability in marimo. Table of Contents Overview Architecture Quick Start Step-by-Step Walkthrough Step 1:...

CVE-2026-23550

CVE-2026-23550 Modular DS header'User-Agent'; $userAgentMatches = $userAgent && Str::is'ModularConnector/ Linux', $userAgent; $originQuery = $request-has'origin' && $request-get'origin' === 'mo'; $isFromQuery = $originQuery || $userAgentMatches && $request-has'type'; // When is wp-load.php reques...

CVE-2026-29000

Simple script that exploits CVE-2026-29000. All you need is the public key in the PEM format and you can use this. For more info on the vulnerability read: https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key...

CVE-2023-22527

CVE-2023-22527 Atlassian Confluence - Remote Code Execution CVE-2023-22527 Poc POST /template/aui/text-inline.vm HTTP/1.1 Host: localhost:8090 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/119.0.6045.159 Safari/537.36 Content-Type:...

CVE-2026-29000

CVE-2026-29000 — pac4j-jwt JWE Authentication Bypass CTF lab for researching the JWE authentication vulnerability in the pac4j-jwt library CVSS 9.3 Critical · CWE-287 · Affected: pac4j-jwt ← access admin panel ↓ Read sensitive data: employee list, system config, flag Project structure...

CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 - Omisión de autenticación para extraer usuarios administradores y configuración LDAP - Este PoC solo realiza acciones de solo lectura. Ejecutar exploit USE: python3 exploit.py https://target.com Ex: python3 exploit.py https://target.com Ejecutar plantilla de nuclei...

cpanel-cve-2026-41940-ioc

CVE-2026-41940 IOC Scanner Detection script for the cPanel/WHM authentication bypass CVE-2026-41940 affecting all cPanel versions after 11.40. This is a rewrite of the upstream cPanel detection script with fixes for false positives and added log correlation. What it does Scans...

CVE-2026-35616

CVE-2026-35616 — FortiClient EMS Pre-Auth Bypass Proof of Concept PoC for FortiClient Endpoint Management Server authentication bypass CVE-2026-35616 This script exploits an authentication bypass vulnerability in FortiClient EMS that allows unauthenticated access to protected API endpoints...

Log-4j-scanner

log4j-scan A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts Features Support for lists of URLs. Fuzzing for more than 60 HTTP request headers not only 3-4 headers as previously seen tools. Fuzzing for HTTP POST Data parameters. Fuzzing for JSON data parameters...

CVE-2026-34486-poc

CVE-2026-34486 Apache Tomcat EncryptInterceptor Bypass Vulnerability Reproduction 1. Vulnerability Overview Attribute| Details ---|--- CVE ID| CVE-2026-34486 Severity| Important / High CVSS 3.1: 7.5 Vulnerability Type| CWE-311 Missing Encryption of Sensitive Data / CWE-807 Reliance on Untrusted...

UAC_bypass_windows_store

UACbypasswindowsstore Windows 10 LPE UAC Bypass en Windows Store WSReset.exe uacbypassmod.c exe está totalmente automatizado. no necesitas ejecutar UAC.bat . método de registro : https://github.com/sailay1996/FilelessUACbypassWSReset...