CVE-2025-25257

CVE-2025-25257 CVE‑2025‑25257 هي ثغرة أمنية حرجة من نوع حقن SQL قبل المصادقة تؤثر على مكون Fabric Connector في Fortinet FortiWeb. وتؤثر على الإصدارات التالية من FortiWeb: 7.6.0–7.6.3 7.4.0–7.4.7 7.2.0–7.2.10 ≤ 7.0.10 التفاصيل التقنية توجد المشكلة في الدالة getfabricuserbytoken التي تقوم ببناء...

CVE-2022-3172

عرض CVE-2022-3172 تشغيل poc.sh لإنشاء الموارد root@kitploit: chmod +x poc.sh ./poc.sh استخدام Curl root@kitploit: curl https://kubernetes.default.svc/apis/metrics.k8s.io/v2beta1/ -k -H "Authorization: Bearer token"...

CVE-2026-61614

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...

CVE-2026-85154

WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...

CVE-2026-85154 WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash

WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...

CVE-2026-85154

WWBN AVideo contains an authentication failure in its video_id_hash credential, which acts as a non-expiring, non-revocable bearer token granting full administrator session access to the video owner's account. An attacker who obtains this token can replay it indefinitely to authenticate as the ow...

EUVD-2026-70389

WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...

CVE-2026-85154 WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash

WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...

poc_cve-2026-42208

CVE-2026-42208 — حقن SQL قبل المصادقة في LiteLLM بيئة مختبرية لإعادة إنتاج وكشف CVE-2026-42208 ، وهي ثغرة حرجة لحقن SQL قبل المصادقة في LiteLLM حيث تصل رموز Bearer غير المنقحة إلى استعلام PostgreSQL خام. نظرة عامة على الثغرة...

CVE-2026-42208-Lab

CVE-2026-42208 — إثبات المفهوم الزمني لحقن SQL قبل المصادقة في LiteLLM مختبر Docker محلي وإثبات مفهوم بأقل ضرر لـ CVE-2026-42208، وهي ثغرة حقن SQL قبل المصادقة في مسار التحقق من مفتاح API في LiteLLM Proxy. يوضح هذا المستودع الفرق بين نسخة LiteLLM المعرضة للثغرة ونسخة LiteLLM المصححة باستخدام إثبا...

PT-2026-84986

WWBN AVideo contains an authentication failure vulnerability where the video id hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video id hash can replay it indefinitely to authenticate...

BerriAI LiteLLM Improper Authentication Vulnerability

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token...

CVE-2026-18730 Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token

A server-side request forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster...

CVE-2026-84115

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

PT-2026-84292

Name of the Vulnerable Software and Affected Versions Cleo Harmony versions 5.8.1.0 through 5.8.1.10 Description An issue exists in the JWT JSON Web Token refresh token handler within the /api/connections endpoint. A remote attacker can manipulate the Bearer argument in HTTP headers to bypass...

SnaffPoint

SnaffPoint Was ist das? SnaffPoint ist ein Tool für Pentester, die etwas Süße in dieser Welt brauchen. Es soll dir helfen, sensible Dateien zu finden, die auf SharePoint Online und in freigegebenen OneDrive-Dateien deines Unternehmens oder deines Kunden verfügbar sind. Wie funktioniert es? Es gib...

CVE-2026-81715

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2026-81101

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...

CVE-2026-81715 openssl_encrypt before 1.4.9 Credential Exposure via Debug Output

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2026-81715 openssl_encrypt before 1.4.9 Credential Exposure via Debug Output

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...