CVE-2026-41940_exploit

============================================================================= CVE-2026-41940 - cPanel & WHM Authentication Bypass Exploit Vulnerability: Session-file manipulation through CRLF injection in cpsrvd's HTTP Basic authentication handler CVE: CVE-2026-41940 CVSS: 9.8 Critical CWE: CWE-9...

CVE-2026-8181

CVE-2026-8181 Proof of Concept Research • Validation • Security Testing "roses a red, violet are blue, i think i just shat my pant thinking about you. rizz" CVE Overview Field| Value ---|--- CVE ID| CVE-2026-8181 Type| Authentication Bypass Impact| Privilege Escalation / Full Site Takeover Attack...

CVE-2026-114221

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in use...

EUVD-2026-108004

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in use...

CVE-2026-114221

The NT OneAPP software developed by NewType Infortech contains a Credential Disclosure vulnerability. Under specific conditions, unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source within the WebView . This flaw allows attackers to obtain...

CVE-2026-114221 NewType Infortech｜NT OneAPP - Credential Disclosure

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in use...

CVE-2026-114657 Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri

Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHPAUTHUSER and PHPAUTHPW, inside an inline style background image t...

CVE-2026-114657

Grav versions 2.0.0 before 2.2.5 are vulnerable to an information disclosure flaw. The issue occurs because authors can print the request Uri object —which contains the PHP_AUTH_USER and PHP_AUTH_PW environment variables—within Twig page content. An attacker or malicious page author can embed thi...

EUVD-2026-107899

Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHPAUTHUSER and PHPAUTHPW, inside an inline style background image t...

CVE-2026-114470 Cross-Site Request Forgery (CSRF) in hMailServer

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

EUVD-2026-107313

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

CVE-2026-114470 Cross-Site Request Forgery (CSRF) in hMailServer

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

CVE-2026-114470

Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are vulnerable to a Cross-Site Request Forgery (CSRF) in the REST API . The root cause is that while the API protects cookie-based sessions, it does not apply the same protections to HTTP Basic authentication . Because browsers cache Basi...

PT-2026-120648

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

CVE-2026-76083

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured...

EUVD-2026-101516

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured...

CVE-2026-76083

The Redash data visualization package is vulnerable in versions 10.0.0 through 26.9.0 . The JSON data source query runner (specifically in redash/query_runner/json_ds.py) improperly uses urljoin to combine a configured base_url with a user-supplied query URL. Because an absolute query URL can rep...

CVE-2026-76083: Server-Side Request Forgery (SSRF)

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured...

Linux Distros Unpatched Vulnerability : CVE-2026-93582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER...

CVE-2026-110097

Ikaros versions 1.2.0 through 1.2.5 are vulnerable to an authentication bypass (CWE-287) that allows attackers with a valid password to skip TOTP verification . By reusing a login temp token obtained from the jwt/apply endpoint, an attacker can present it as a bearer JWT , refresh it, or use HTTP...