CVE-2025-25257

CVE-2025-25257 CVE‑2025‑25257 es una vulnerabilidad crítica de inyección SQL sin autenticación que afecta al componente Fabric Connector de Fortinet FortiWeb. Afecta a las versiones de FortiWeb: 7.6.0–7.6.3 7.4.0–7.4.7 7.2.0–7.2.10 ≤ 7.0.10 Detalles Técnicos El problema reside en la función...

CVE-2026-80099

CVE-2026-80099 PoC Bypass de autenticación no autenticado y exploit de RCE dirigido a plugins de WordPress de Newfold que incluyen wp-module-data. Descripción general Esta herramienta explota un fallo de validación de token Bearer en el módulo wp-module-data de Newfold. Cuando un sitio de WordPre...

CVE-2026-42208-Lab

CVE-2026-42208 — PoC de inyección SQL por tiempo previa a la autenticación en LiteLLM Laboratorio Docker local y PoC de daño mínimo para CVE-2026-42208, una vulnerabilidad de inyección SQL previa a la autenticación en la ruta de verificación de claves API del proxy LiteLLM. Este repositorio...

EUVD-2026-85920

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

poc_cve-2026-42208

CVE-2026-42208 — Inyección SQL sin autenticación en LiteLLM Un entorno de laboratorio para reproducir y detectar CVE-2026-42208 , una vulnerabilidad crítica de inyección SQL sin autenticación en LiteLLM donde tokens Bearer no sanitizados llegan a una consulta PostgreSQL sin parámetros. Resumen de...

CVE-2026-77394 OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with systemset permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by...

CVE-2026-77394 OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with systemset permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by...

CVE-2026-77394 OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with systemset permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by...

CVE-2022-3172

Demostración de CVE-2022-3172 Ejecutar poc.sh para crear recursos root@kitploit: chmod +x poc.sh ./poc.sh Usar Curl root@kitploit: curl https://kubernetes.default.svc/apis/metrics.k8s.io/v2beta1/ -k -H "Authorization: Bearer token"...

CVE-2026-82355

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-86473

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-86473

Apache Airflow 's Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out using an Authorization bearer header , the endpoint returns a normal logout response but does not revoke the token , leaving it valid until its natural expiry (default 24...

CVE-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-82355

Apache Airflow versions 3.3.0 and 3.3.1 are vulnerable to an Incorrect Authorization issue where the system prioritizes a session cookie over an explicit Authorization: Bearer token. This inversion of precedence allows an attacker who successfully plants a session cookie—via cookie tossing , cros...

CVE-2026-86473: Insufficient Session Expiration

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

SnaffPoint

SnaffPoint Qué es SnaffPoint es una herramienta para pentesters que necesitan un poco de dulzura en este mundo. Debería ayudarte a encontrar archivos sensibles disponibles en SharePoint online y en archivos compartidos de OneDrive de tu empresa o de tu cliente. Cómo funciona En realidad hay 2...

CVE-2026-61833

zot , an OCI Distribution Specification-based container image registry, is affected in versions prior to 2.1.18 by an authorization flaw. The bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the "push" action, so DELETE requests are never checked...

Security Bulletin: Vulnerable Version of Software in Use

Summary Vulnerable Version of Software in Use: Prior versions include vulnerable version of curl. Vulnerability Details CVEID:CVE-2026-3783 DESCRIPTION: When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to...

EUVD-2026-82405

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...