CVE-2023-43208

CVE-2023-43208 — Mirth Connect 事前認証RCE NextGen Healthcare Mirth Connect CVSS 9.8 Critical — CVE-2023-37679 のパッチバイパス 概要 Mirth Connect は、Java XStream ライブラリを使用して /api/users エンドポイントで 認証なしで XML ペイロードをデシリアライズします。当初の修正 CVE-2023-37679 では危険なクラスの拒否リストが導入されましたが、Apache Commons Lang3 の...

wordlist_generator

wordlistgenerator wordlistgenerator 도구는 tomnomnom의 비디오 "Who, What, Where, When"에 언급된 기술을 사용하여 대상에 맞는 고유한 워드리스트를 생성합니다. gau에서 URL을 가져와 페이지의 디렉터리, 파일 이름 또는 단어를 추출합니다. 추가 기능으로 HTML 주석을 추출할 수 있습니다. 기본적으로 도구는 2000개의 URL만 요청하고 모든 단어와 디렉터리를 추출합니다. 워드리스트를 정리하기 위해 wordlistgenerator는 "denylists" 디렉터리 파일의 모...

CVE-2026-54567

Flask-Reuploaded versions from 1.5.0 to before 1.6.0 are affected by a case-folding asymmetry in the name-override path of UploadSet.save(). When a caller supplies a name override, the extension re-validation uses the case-preserving extension() helper instead of the case-normalizing lowercase_ex...

CVE-2026-77883 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's if...

CVE-2026-77883

Apache Syncope is affected by an information disclosure vulnerability in its Derived Schemas functionality. The root cause is a one-hop JEXL navigation that bypasses the JexlContextBuilder name denylist , allowing an administrator with adequate Derived Schemas entitlements to craft a malicious JE...

CVE-2026-89012

CVE-2026-89012 — Dolibarr SQLフィルタ拒否リストバイパス CVE-2026-89012のエクスプロイト: forgeSQLFromUniversalSearchCriteria における 禁止フィールド拒否リストCVE-2026-71510の修正で導入されたは、 大文字小文字を区別する inarray を使用している一方、オペランドの文字セットは A-Z を許可している。SQLのカラム解決は大文字小文字を区別しないため、 認証済みAPIユーザーは t.passcrypted の代わりに t.PASSCRYPTED を クエリすることで拒否リストをバイパスできる...

GHSA-65H7-9WRW-629C FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname...

CVE-2026-69263

CVE 2026-69263 概述 CVE 2026-69263 是 2025 年 8 月修补的旧 RCE 漏洞的补丁绕过。该补丁引入了一个阻止列表（Denylist），用于阻止任意包的安装。 原理 由于 npm 会从环境变量读取配置，设置 npmconfigyes=true 环境变量会重新启用被阻止的行为。 受影响版本 Flowise 3.1.1（报告时为止的最新版本）。已在 3.1.3 中修复。 PoC 以下 MCP 服务器配置通过 CUSTOMMCPSECURITYCHECK=true 绕过了该补丁： root@kitploit: "mcpServers": "bypass":...

CVE-2026-89012

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

CVE-2026-89012 Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

EUVD-2026-76141

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

CVE-2026-89012

Dolibarr 24.0.0 (before 24.0.1 ) is affected by a case-sensitive denylist bypass in the sqlfilters API query parameter. The root cause is a mismatch between the case-sensitive denylist check in the core library and the case-insensitive database column resolution , allowing authenticated attackers...

CVE-2026-89012 Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

EUVD-2026-75800

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner...

PT-2026-90548

Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname...

fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization

A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode Internationalized Domain Name - IDN hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when...

CVE-2026-78569

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner...

CVE-2026-78569 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner...

CVE-2026-78569

IBM Langflow OSS (versions 1.0.0 through 1.11.5) is vulnerable to arbitrary code execution by an authenticated attacker due to an incomplete denylist in its agentic assistant code security scanner. The scanner omits process-spawning primitives and contains a logic error where annotated class-body...

EUVD-2026-75674

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...