Lucene search
+L

8280 matches found

EUVD
EUVD
added 2026/09/16 1:53 p.m.5 views

EUVD-2026-80762

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

4.2CVSS5.7AI score0.00105EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/16 1:53 p.m.30 views

CVE-2026-92138

Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier is vulnerable in its OAuth authorization endpoint , which reads the oauth_callback URL from the user-submitted form instead of the server-side stored request token. This allows an attacker to hijack the OAuth flow and obtain an access ...

4.2CVSS5.7AI score0.00105EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/16 1:53 p.m.37 views

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

0.00105EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/16 2:47 a.m.10 views

Simplog-Exploit

Simplog-Exploit This repository contains the setup, exploit and patch for CVE-2009-4092 Simplog CSRF Vulnerability. The vulnerabily exists in the user.php file of Simplog 0.9.3.2, a web application used for providing people with an easy way to create and maintain a blog on their personal websites...

6.8CVSS5.8AI score0.05365EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/15 9:27 p.m.13 views

tenda-ac8v4-rop

Tenda-Ac8v4-PoC Tenda Ac8v4 desbordamiento basado en pila a ejecución remota de código mediante secuestro del flujo de ejecución y explotación por manipulación de múltiples registros; los CVE son: CVE-2023-33675 CVE-2023-33673 CVE-2023-33672 CVE-2023-33671 CVE-2023-33670 CVE-2023-33669 Marcados...

9.8CVSS7.9AI score0.02089EPSS
SaveExploits7
Github Security Blog
Github Security Blog
added 2026/09/15 8:00 p.m.7 views

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains...

6.8CVSS5.8AI score0.00426EPSS
SaveExploits0References5Affected Software3
Kitploit
Kitploit
added 2026/09/15 4:56 p.m.13 views

Byepervisor

Byepervisor Resumen Exploit del hipervisor de PS5 para firmware = 2.xx. El repositorio contiene dos vulnerabilidades y cadenas de exploit independientes entre sí; cualquiera de ellas puede usarse. Un exploit se incluye principalmente con fines de preservación /oldjumptableexploit; solo es necesar...

6AI score
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/09/15 3:04 p.m.10 views

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

9.8CVSS5.7AI score0.00693EPSS
SaveExploits0References7
RedHat Linux
RedHat Linux
added 2026/09/15 3:04 p.m.8 views

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

9.8CVSS5.7AI score0.00693EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/15 6:31 a.m.10 views

CVE-2026-48095

CVE-2026-48095 7-Zip es un archivador de archivos con una alta relación de compresión. Las versiones 26.00 y anteriores contienen una vulnerabilidad de desbordamiento de búfer en el montón causada por una asignación insuficiente en el búfer de flujo comprimido NTFS GetCuSize shift UB, lo que...

8.8CVSS8.4AI score0.01116EPSS
SaveExploits1
NVD
NVD
added 2026/09/15 6:16 a.m.9 views

CVE-2026-81303

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who...

6.3CVSS0.00273EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/15 5:35 a.m.32 views

CVE-2026-81303 Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who...

6.3CVSS0.00273EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/15 5:35 a.m.13 views

CVE-2026-81303

CVE-2026-81303 affects hawtio-operator , a Kubernetes operator. The operator holds the routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks....

6.3CVSS5.8AI score0.00273EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/15 5:35 a.m.7 views

EUVD-2026-78275

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who...

6.3CVSS5.8AI score0.00273EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/09/15 5:12 a.m.8 views

CVE-2026-81303

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who...

6.3CVSS5.8AI score0.00273EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/09/15 12:00 a.m.6 views

RHEL 7 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 7.4.25 (RHSA-2026:67604)

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67604 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This...

9.8CVSS5.9AI score0.00693EPSS
SaveExploits0References12
Kitploit
Kitploit
added 2026/09/14 11:23 p.m.9 views

CVE-2025-55182-RCE-shell

CVE-2025-55182-RCE-shell Burp Suite/antsword - Shell interactiva secuestro HTTP + POST + AES-256-CBC/BASE64 Detección -dnslog Detección sin salida de DNSLog Nuclei -poc Detección de eco de vulnerabilidad Explotación -exp Shell interactiva eco base64 -exp2 Shell interactiva secuestro HTTP + POST +...

10CVSS7.7AI score0.99802EPSS
SaveExploits391
Kitploit
Kitploit
added 2026/09/14 7:42 p.m.9 views

CVE-2025-34077

CVE-2025-34077 Secuestro de sesión de administrador no autenticado - Plugin Pie Register ≤ 3.7.1.4 📌 Descripción Este exploit apunta a una vulnerabilidad en el plugin Pie Register de WordPress versiones ≤ 3.7.1.4, permitiendo el secuestro de sesión de administrador no autenticado. 🛡️ Esta...

10CVSS8.2AI score0.15083EPSS
SaveExploits7References2
OSV
OSV
added 2026/09/14 5:53 p.m.4 views

CVE-2026-54176 backpack/crud: MyAccountController allows changing the login email without a current-password check

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits...

6.5CVSS5.8AI score
SaveExploits0References9
Kitploit
Kitploit
added 2026/09/14 2:47 p.m.6 views

CVE-2025-29824-Exploit

🚨 Exploit CVE-2025-29824: Cadena de Ransomware PipeMagic 📌 Resumen de Vulnerabilidad Crítica Fallo de Escalada de Privilegios en Windows CLFS → Secuestro de Privilegio SYSTEM Explotado en Ataques Activos de Ransomware por Storm-2460 Threat Group 🖥️ Sistemas Afectados Expandir Lista de Sistemas 🧩...

7.8CVSS7.8AI score0.13904EPSS
SaveExploits5
Rows per page
Query Builder