POC-CVE-2026-1357

CVE-2026-1357 WPvivid Backup & Migration RCE PoC 发现者： Lucas Montes NiRoX 漏洞类型： 未认证任意文件上传导致远程代码执行（RCE） CVE ID： CVE-2026-1357 CVSS 评分： 严重（9.8） 状态： 已在 0.9.124 版本中修复 概述 本仓库包含对 WPvivid Backup & Migration WordPress 插件（版本 = 0.9.123）中一个严重漏洞的分析和概念验证（PoC）。 该漏洞允许未认证攻击者 向服务器上传任意文件（如 PHP 木马），从而立即实现远程代码执行（RCE）...

CVE-2026-34486

CVE-2026-34486 Apache Tomcat Tribes 集群中 EncryptInterceptor 存在 fail-open 绕过漏洞，导致通过 Java 反序列化实现未授权远程代码执行（RCE）。 受影响版本：11.0.19+、10.1.53+、9.0.116+。 修复版本：11.0.21、10.1.54、9.0.117。 由 Bartlomiej Dmitruk striga.ai 发现并报告。 技术文章：https://striga.ai/research/tomcat-tribes-unauth-rce 需求 Docker Java 21 Python 3 使用...

ams-failopen

AppleMediaServices 中的失效开放签名（零日披露） 概述 此问题构成了一个现有的零日漏洞，反映了 AppleMediaServices.framework 中的系统性设计缺陷，而非回归或特定版本的错误。 Apple 的 AppleMediaServices 框架中存在一个关键的失效开放缺陷：如果远程配置文件（"Bag"）加载失败，请求签名会被静默禁用。这影响 iOS、macOS、tvOS 和 watchOS。 当 Bag 无法检索（由于 DNS 操纵、超时或网络干扰）时，AppleMediaServices 守护进程会禁用 Mescal/Absinthe 签名，并向...

CVE-2026-61595

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

EUVD-2026-80851

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

Dolibarr <=22.0.4 - Local File Inclusion

Dolibarr = 22.0.4 contains a local file inclusion caused by manipulation of the objectdesc parameter and a fail-open logic flaw in restrictedArea in /core/ajax/selectobject.php, letting authenticated users with no specific privileges read arbitrary non-PHP files. id: CVE-2026-34036 info: name:...

CVE-2026-1357-POC

CVE-2026-1357 — WPvivid Backup & Migration RCE Crédito CVE: Lucas Montes NiRoX Herramienta por: CyberTechAjju CVSS: 9.8 Crítico | Afecta: ≤ 0.9.123 | Parcheado: 0.9.124 ⚠️ Aviso Legal Solo para pruebas de seguridad autorizadas. El acceso no autorizado a sistemas es ilegal. Resumen RCE sin...

CVE-2026-53913

CVE-2026-53913 — camel-keycloak 故障开放（Fail-Open）身份验证绕过 针对同一 Apache Camel 漏洞的可运行概念验证（PoC）复现程序，每种运行时一个： 运行时| 目录| 技术栈 ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Camel Quarkus 3.36.0（集成了 Camel 4.20.0 ）...

CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

CVE-2026-34486 Apache Tomcat Tribes 集群中 EncryptInterceptor 的 fail-open 绕过，导致通过 Java 反序列化实现未授权远程代码执行（RCE）。 受影响版本：11.0.19+、10.1.53+、9.0.116+。 修复版本：11.0.21、10.1.54、9.0.117。 发现并报告者：Bartlomiej Dmitruk（striga.ai）。 技术分析：https://striga.ai/research/tomcat-tribes-unauth-rce 环境要求 Docker Java 21 Python 3 用法...

CVE-2026-86259

CVE-2026-86259 - OpenMAIC 1.0.0：通过 Fail-Open 中间件与环境门控验证绕过实现未认证出站 SSRF 至云元数据服务 概述 已验证。OpenMAIC 的认证中间件与出站提供商请求层中存在一条两段式利用链，允许未认证的远程攻击者使应用服务器发起任意出站 HTTP 请求——包括访问位于 169.254.169.254 的云实例元数据服务（IMDS）——而无需持有任何凭据。 第一段： middleware.ts 中的 Next.js Edge 中间件在 ACCESSCODE 环境变量缺失时采用 fail-open 姿态。在默认的 .env.example...

CVE-2026-70376

CVE-2026-70376 — Pluck CMS 全站 CSRF → RCE 宽松模式（fail-open）的 Referer 校验 + 无 CSRF 令牌 + 双扩展名上传 管理员仅需访问一次页面，即可删除内容、注入页面并植入 WebShell 概览 · 摘要 · 根因 · 攻击链 · 利用 · 修复建议 · 时间线 📋 概览 🔎 摘要 Pluck 管理后台在整个代码库中没有任何基于请求的 CSRF 令牌 。每个改变状态的管理操作都由同一个函数把关，即 requestedByTheSameDomain，它唯一的防御是 Referer 主机名比对...

CVE-2026-53459 Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database...

DEBIAN-CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-90711 proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

EUVD-2026-78300

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-90711

proxy-addr is a Node.js module that backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7 , a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g., ::ffff:10.0.0.0/8 instead of /104) is silently accepted, causing every IPv4 address to be treated as trusted...

CVE-2026-65838

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

CVE-2026-65838 Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

CVE-2026-65838 Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...