419 matches found
MLflow Job API - Authentication Bypass
MLflow latest version contains an authentication bypass caused by unprotected FastAPI job endpoints under /ajax-api/3.0/jobs/ when basic-auth is enabled, letting unauthenticated network clients submit and manage jobs, exploit requires job execution enabled and allowlisted job functions. id:...
EUVD-2026-116592
ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name fr...
CVE-2026-121734
ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name fr...
CVE-2026-120627
The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later...
CVE-2026-120627
The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler . This vulnerability allows for the leakage of PIA proxy credentials when a user visits a malicious website that issues a Basic auth challenge . While the issue was previously addressed i...
EUVD-2026-115353
The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later...
CVE-2026-120627 CVE-2026-120627
The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later...
PT-2026-135548
The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later...
CVE-2026-120627: Private Internet Access Firefox extension: The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading…
The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later...
CVE-2026-41940_exploit
============================================================================= CVE-2026-41940 - cPanel & WHM Authentication Bypass Exploit Vulnerability: Session-file manipulation through CRLF injection in cpsrvd's HTTP Basic authentication handler CVE: CVE-2026-41940 CVSS: 9.8 Critical CWE: CWE-9...
certbot
.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...
phpBB-CVE-2026-48611
USE AT YOUR OWN RISK. This tool is provided strictly for authorized security research, penetration testing, and educational purposes. Only run it against systems you own or have explicit, written permission to test. The author is not responsible or liable for any illegal or unethical use of this...
CVE-2025-1739
CVE-2025-1738 & CVE-2025-1739 — Trivision Camera NC227WF PoC 📋 Overview CVE| CVSS v3.1| Score| CWE| Type ---|---|---|---|--- CVE-2025-1739| AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N| 7.1| CWE-288| Authentication Bypass via Basic Auth Leak 🔓 CVE-2025-1739 — Basic Auth Code Exposure / Auth Bypass CWE-288...
gitea-CVE-2026-28699
CVE-2026-28699: Gitea OAuth2 Scope Bypass via HTTP Basic Auth A Gitea OAuth2 access token scoped to only read:user can perform full write actions when it is sent as Authorization: Basic base64:x-oauth-basic instead of as a Bearer token. The scope check is skipped for any token presented over Basi...
vicidial-cve-2024-8503-blind-sqli-poc
vicidial-cve-2024-8503-blind-sqli-poc Unauthenticated time-based blind SQL injection proof of concept for VICIdial's VERMAJAXfunctions.php endpoint CVE-2024-8503. The project is intended for authorized security testing, validation, and education only. Overview CVE-2024-8503 is an unauthenticated...
CVE-2025-4476-Exploit
CVE-2025-4476-Exploit A small Python test client to send HTTP GET requests with an oversized Authorization: Basic header. This tool is intended for lab testing and research into header-parsing issues e.g., null-dereference / crash bugs such as CVE-2025-4476 in libsoup. It demonstrates how a...
CVE-2026-22114
HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible...
CVE-2026-22114 Missing brute-force protection for web interface
HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible...