CVE-2026-84716 Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

EUVD-2026-85611

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

CVE-2026-84716

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

CVE-2026-71458

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...

CVE-2026-71458

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...

EUVD-2026-85523

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...

CVE-2026-71458

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...

CVE-2026-84716: Incorrect Privilege Assignment

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

CVE-2024-29671-POC

NEXTU FLETA Wifi6 Router RCE Exploit POC 本文書では、NEXTU FLATA AX1500 ルーターファームウェアにおいて CVE-2024-29671 の脆弱性がどのように悪用されたかを説明します。 実行環境 このルーターは、Realtekチップセットを採用したMIPSアーキテクチャ（リトルエンディアン）に基づいています。 対象ルーターのファームウェアバージョンは v1.0.2 です。 このファームウェアには、2005年に最後にリリースされた組み込みWebサーバーである "boa" が含まれています。 ただし、このルーターは boa...

CVE-2025-32462-Exploit

CVE-2025-32462-Exploit: Matrix-Sudo Escape ホスト名スプーフィングによる権限昇格 CVE-2025-32462 「青い薬を飲めば…話は終わる。赤い薬を飲めば…rootを手に入れる。」 説明 このエクスプロイトは、sudoの権限昇格脆弱性（CVE-2025-32462）を示しています。この脆弱性では、-hフラグを使用してホスト名ベースの制限をバイパスできます。PoCは、制限付きユーザー環境を作成し、許可されたホスト名を偽装してそれを脱出し、rootアクセスを取得します。 root@kitploit: user@matrix-node$ sudo -...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2026-34207

CVE-2026-34207 SSRFフィルターはホスト名のテキストをチェックしていましたが、実際の接続先は後でDNSによって決定されました。このギャップにより、攻撃者が制御するWebhook URLがループバック、メタデータ、プライベートネットワークのターゲットに到達可能になりました。 はじめに この問題は、オープンソースのチャットボットビルダーであるTypebot をレビューしているときに、シンプルなセキュリティの問いを念頭に発見しました。 SSRF保護がホスト名のテキストを検証しても、実際の接続先が後でDNSによって決定されたらどうなるか？...

CVE-2018-19518

CVE-2018-19518 最新のレポートはこちら : https://gitlab.com/ensimag-security/CVE-2018-19518/-/jobs/artifacts/master/raw/rapport.pdf?job=PDF 使用方法 アプリの起動 root@kitploit: docker-compose up -d Webアプリの通常の使用例。 imap : webmail.grenoble-inp.org ユーザー : [email protected] パスワード : xxx エクスプロイト 以下のコマンドを使用： echo...

RHEL 10 : Red Hat JBoss Enterprise Application Platform 8.1.8 (RHSA-2026:70230)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70230 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release...

Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15 fix 3.4.16, 3.3.0–3.3.18 fix 3.3.19, 2.7.0–2.7.32 fix 2.7.33; Cassandra SSL...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.1.8 (RHSA-2026:70228)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70228 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release ...