CVE-2026-108738

The Traccar application (versions 5.7 through 6.16.0 ) is vulnerable to a Login CSRF attack via the OpenID Connect callback. The root cause is that the application fails to validate the OAuth state parameter during the callback process. An attacker can force a victim's browser to load the /api/se...

CVE-2026-108738 Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load...

EUVD-2026-96904

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load...

dex

dex - Um provedor de OpenID Connect federado O Dex é um serviço de identidade que usa OpenID Connectopenid-connect para conduzir a autenticação de outros aplicativos. O Dex atua como um portal para outros provedores de identidade por meio de "conectores." Isso permite que o dex delegue a...

OnionHop

OnionHop V3 OnionHop V3 é um aplicativo de desktop moderno e multiplataforma Windows, macOS e Linux que roteia seu tráfego através do Tor. Ele pode executar o Tor como um proxy SOCKS local ou como um túnel de todo o sistema, escolher automaticamente uma estratégia de conexão funcional para sua re...

ADSyncDump-BOF

ADSyncDump BOF O BOF ADSyncDump é uma adaptação do adconnectdump.py / ADSyncDecrypt de Dirkjan Mollema para um Beacon Object File BOF para uso com Cobalt Strike, Sliver e Havoc. !NOTE A ferramenta foi testada em um Windows Server 2019 com Azure AD Connect versão 2.2.1.0. A versão de 32 bits do BO...

boundary

O Boundary Community Edition CE não está mais em desenvolvimento ativo, e este repositório foi arquivado em 8 de outubro de 2026. O desenvolvimento futuro do Boundary será focado no HCP Boundary e no Boundary Enterprise, onde podemos oferecer capacidades de acesso humano e agêntico de nível...

kratos

Chat · Discussões · Newsletter · Documentação · Experimente o Ory Network · Vagas Ory Kratos é um sistema de gerenciamento de identidade e usuários API-first para aplicações nativas da nuvem. Ele centraliza fluxos de login, registro, recuperação, verificação e gerenciamento de perfil para que seu...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — front sequestro de sessão OIDC Front estático que executa o fluxo OIDC authorization code contra um Keycloak e expõe o hook de sequestro de sessionid do PoC. É servido com nginx na porta 5174 para uso da equipe. Subir na VPS cd vps/pocCVE0264 docker compose up -d --build Fica ...

WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion

Patreon WordPress before version 1.7.0 is vulnerable to unauthenticated local file inclusion that could be abused by anyone visiting the site. Exploitation by an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the...

iSpy 7.2.2.0 - Authentication Bypass

iSpy 7.2.2.0 contains an authentication bypass vulnerability. An attacker can craft a URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-29775 info: name: iSpy 7.2.2.0 - Authentication Bypass author: arafatansari severity: critical...

RStudio Connect - Open Redirect

RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites. id: CVE-2022-38131 info: name: RStudio Connect - Open Redirect author: xxcdd severity: medium description: | RStudio Connect prior to...

Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)

Pulse Secure Pulse Connect Secure PCS 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3 contain a reflected cross-site scripting caused by insufficient sanitization on the Application Launcher page, letting attackers execute scripts in the context of the affected page, exploit requires victim to visit ...

hydra

Bate-papo · Discussões · Newsletter · Documentação · Experimente Ory Network · Vagas Ory Hydra é um servidor OAuth 2.0 robusto e certificado OpenID, e um provedor OpenID Connect otimizado para baixa latência, alta vazão e baixo consumo de recursos. Ele conecta-se ao seu provedor de identidade...

naabu

Features • Installation • Usage • Running naabu • Config • NMAP integration • CDN/WAF Exclusion • Discord Naabu is a port scanning tool written in Go that allows you to enumerate valid ports for hosts in a fast and reliable manner. It is a really simple tool that does fast SYN/CONNECT/UDP scans o...

EUVD-2026-96400

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports...

CVE-2024-21893.py

CVE-2024-21893 é uma vulnerabilidade de falsificação de solicitação no lado do servidor SSRF no componente SAML do Ivanti Connect Secure 9.x, 22.x e Ivanti Policy Secure 9.x, 22.x e Ivanti Neurons for ZTA que permite que um atacante acesse certos recursos restritos sem autenticação. Execute pytho...