EUVD-2026-78680

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...

CVE-2026-77866

Slab safeurl (an Elixir library, affected from version 0.1.0 onward) contains a Server-Side Request Forgery (SSRF) protection bypass that allows an attacker controlling a validated URL to reach internal network destinations the library is configured to block. The root cause is that only IPv4 addr...

EUVD-2026-78678

Server-Side Request Forgery SSRF vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated a...

EUVD-2026-78676

Time-of-check Time-of-use TOCTOU Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive t...

CVE-2026-43914-PoC

CVE-2026-43914 — Vaultwarden 邮箱双因素认证暴力破解防护绕过 CVE-2026-43914 的概念验证：当启用邮箱双因素认证（Email 2FA）时，Vaultwarden 的登录暴力破解防护可通过未认证的POST /api/two-factor/send-email-login 端点被完全绕过，该端点充当无限制的主密码预言机。 受影响版本：Vaultwarden MailHog docker run -d --name vw-lab -p 8222:80 --link mailhog \ -e IREALLYWANTVOLATILESTORAGE=true ...

POC-CVE-2026-18963

CVE-2026-18963 — Keycloak 忘记密码流程认证绕过 PoC 针对 CVE-2026-18963 的概念验证，该漏洞存在于 Keycloak 的“忘记密码”/凭据选择流程中，攻击者可借此到达 UPDATEPASSWORD 步骤——并重置目标账户的密码——而无需正确完成所需的身份验证（例如，无需有效的 OTP/第二因素）。 该脚本完全通过 HTTP 驱动整个流程（无需浏览器/Selenium），具体步骤如下： 1. 加载领域的登录页面并定位“忘记密码”链接。 2. 打开重置凭据页面并触发 tryAnotherWay。 3. 在生成的凭据选择器中提交用户名。 4. 提取并...

CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account Takeover Unauthenticated account takeover in Keycloak's reset-credentials flow. An attacker who knows only a username/email can reset any user's password — including admins — without ever receiving the verification email. ⚠️ Disclaimer —...

CVE-2026-55636 Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...

EUVD-2026-78670

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...

CVE-2026-8069

从宏碁命名管道到 NT AUTHORITY\SYSTEM：CVE-2026-8069 宏碁 NitroSense 和 PredatorSense 3.x 安装了一个名为 PSSvc 的 Windows 服务，该服务向本地用户暴露了一个自定义命名管道协议。其中一个协议命令接受调用者可控的可执行文件路径，复制 winlogon.exe 的令牌，并以 NT AUTHORITY\SYSTEM 身份启动该可执行文件。 该易受攻击服务中的路径限制是一个子字符串测试。以服务目录开头然后使用 .....

CVE-2026-87792

The "Design Scuole Italia" WordPress theme (versions 1.0–2.17.3 ) is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions. An unauthenticated attacker can access restricted "Circolare" content and registered users' data; an unauthentic...

EUVD-2026-78665

The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed...

CVE-2026-65831

ArcadeDB (Multi-Model DBMS) prior to 26.7.1 is vulnerable to privilege escalation via the POST /api/v1/command/{database} endpoint when using language: js. Two cooperating defects enable the attack: PolyglotQueryEngine.command, .analyze, and .registerFunctions do not enforce database-administrato...

CVE-2026-91991 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-91987 atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the estimatebatchcost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel...

EUVD-2026-78658

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the estimatebatchcost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel...

EUVD-2026-78654

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...

EUVD-2026-78653

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticato...

CVE-2026-91983

Vikunja before 2.6.0 contains an API token scope bypass in its task read endpoints. The root cause is that authorization logic fails to inspect query string parameters , allowing attackers holding limited-scope tokens to leverage the expand parameter to access restricted data such as comments, re...

CVE-2026-91982 Vikunja before 2.6.0 TOTP Secret Disclosure via API

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticato...