CVE-2022-22947

CVE-2022-22947 CVE-2022-22947 Spring-Cloud-Gateway In the first quarter of 2022, an interesting and critical base score of 10.0 Spring Cloud Gateway Code Injection vulnerability was discovered leveraging the Actuator API to perform SpEL Injection, potentially leading to system compromise. Spring...

CVE-2026-90970: Improper Neutralization of Special Elements Used in a Template Engine

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-104417: Improper Limitation of a Pathname to a Restricted Directory

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

PT-2026-104355

Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.1.6 through 19.2.3 GitLab AI Gateway versions 19.3 through 19.3.1 GitLab AI Gateway versions 19.4 through 19.4.0 Description An improper neutralization weakness in the GitLab AI Gateway allows an authenticated use...

PT-2026-104458

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obta...

PT-2026-104436

Name of the Vulnerable Software and Affected Versions Armatura One affected versions not specified Description Armatura One stores database and message-broker credentials in an installation configuration file. When protection is enabled, these credentials are encrypted using AES-128-CBC Advanced...

ROS-20261002-73-0128

The vulnerability in perl-DBI is related to incorrect input of configuration data. The vulnerability can be exploited remotely...

Grafana Labs 12.3.x < 12.4.12 / 13.0.x < 13.0.10 / 13.1.x < 13.1.7 / 13.2.x < 13.2.3 Information Disclosure (CVE-2026-13719)

The version of Grafana Labs installed on the remote host is 12.3.x through 12.4.x prior to 12.4.12, or 13.0.x prior to 13.0.10, or 13.1.x prior to 13.1.7, or 13.2.x prior to 13.2.3. It is, therefore, affected by an information disclosure vulnerability: - An authenticated user can list alert rules...

CVE-2026-104467: Missing Authorization

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...

Brocade ASCG remote Code Execution via Pre-Validation Dynamic Code Evaluation (CVE-2026-85486)

Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code...

Unauthenticated Administrative REST API Access in Brocade ASCG before 3.5.0 (CVE-2026-85489)

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

webhook-cve-2022-0811

webhook-cve-2022-0811 This is a really simple webhook that just blocks pod creation if malicious sysctl values are configured. Build go test CGOENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build Build image an deploy in Minikube Start minikube: minikube start minikube addons enable registr...

CVE-2022-48311

CVE-2022-48311 HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B HTTP configuration page Cross Site Scripting XSS Vulnerability Description Cross Site Scripting XSS in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number...

CVE-2020-26733

CVE-2020-26733 SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 Cross Site Scripting XSS Vulnerability Description Cross Site Scripting XSS in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their...

cve-2025-31651

CVE-2025-36701 — Apache Tomcat - Rewrite rule bypass Discoverer: gregk4sec https://github.com/gregk4sec/cve Discovery Date: 2025-02-28 Affected Vendor: Apache Affected Product: Tomcat 9.0.x / 10.1.x / 11.0.x Severity: Critical / High CWE: CWE-116 Status: Under Review / Fixed / Public ✅ / Private...

CVE-2022-41678

Apache ActiveMQ CVE-2022-41678 Exploit Tool Vulnerability Overview Reference document: https://app.nextcyber.cn/courses/41/tasks/580 CVE-2022-41678 is a remote code execution vulnerability in Apache ActiveMQ. This vulnerability allows an attacker to modify Log4j configuration or JFR Java Flight...

autochrome

autochrome Этот инструмент загружает, устанавливает и настраивает новенькую копию Chromium. Он включает полезные функции, такие как: Отключение всех этих надоедливых автообновлений! Яркие цветные темы для высокой видимости! Без XSS-аудитора! Автоматическая настройка прокси! использует...

cowcloud

CowCloud a serverless solution to distribute work-loads in AWS CowCloud was originally created to run recon tools and vulnerability scans in a distributed way; for example, one use case might be by bug bounty hunters. This solution is intended to abstract end users from the underlying work requir...

go-pillage-registries

go-pillage-registries This project takes a Docker registry and pillages the manifest and configuration for each image in its catalog. It uses Google's crane command's package, which should follow docker's keychain semantics. If you would like to override this, just change authn.DefaultKeychain as...

behat-config-leaks

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install behat-config-leaks Run bellow command to check behat-config-leaks -h Configurations 2. We integrated with the Telegram API to...