@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...

CVE-2026-90443

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...

CVE-2026-2766-but-with-wasm

CVE-2026-2766，但使用 wasm 状态：已验证的崩溃 PoC，并演示了控制流劫持 （崩溃pc = 调试 shell 下已释放单元的毒化值 0xcdcdcdcdcdcdcdcd ——引擎跳转到一个从已释放的 ICScript 中读出的指针）。 剩余工作：控制被回收的字节。参见 research/README.md。 一个 WasmBlazeFox 家族的利用链，针对 2026 年的一个漏洞：CVE-2026-2766，“JavaScript 引擎：JIT 组件中的 JIT 错误编译 / 释放后使用”， 已在 Firefox 148 中修复（MFSA 2026-13）。最终目标与...

randomrepo

SecOpsMaestro POC Github 账户劫持 - Baidu - H1...

slui-file-handler-hijack-privilege-escalation

Slui 文件处理程序劫持 LPE 漏洞信息| ---|--- 日期| 15.01.2018 已修补| Windows 10 20H1 19041 exploit-db| 44830 测试环境| Windows 8-10, x86/x64 通用 描述 slui.exe 是一个自动提升权限的二进制文件，容易遭受文件处理程序劫持攻击。 执行时会读取 HKCU\Software\Classes\exefile\shell\open。由于该注册表项可从用户模式访问，因此可以注入任意可执行文件。 该漏洞利用通常与编程语言和位数无关，因为无需 DLL...

artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0

A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBETOPOLOGYV2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore, no credential...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

PT-2026-89272

An unauthenticated remote attacker can craft a CORE protocol SESSION REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0...

Oracle Linux 8 : ELSA-2026-64794-0: / httpd:2.4 (ELSA-2026-647940)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-647940 advisory. - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves:...

CVE-2026-57163

A flaw was found in PJSIP. A stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate. A remote attacker can exploit this by presenting a specially crafted certificate during the TLS handshake, before SIP-level authentication...

YesWiki <= 4.5.1 - Cross-Site Scripting

YesWiki alertdocument.domain","YesWiki"' - 'statuscode == 200' - 'containscontenttype, "text/html"' condition: and digest: 4a0a0047304502210081b115925fd1dd310b011e8634d8ee40cc42ef1bc9c58737508b82373dc9d395022038cb61d194605963a625a0526e24002c5e2c3366c0f76534d62248af1c47c093:922c6459022...

N-central - Authentication Bypass

N-central 3 matchers-condition: and matchers: - type: word words: - "SessionID" - "sessionHelloResponse" condition: and - type: status...

CVE-2026-66767 Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

Linux Distros Unpatched Vulnerability : CVE-2026-57163

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backen...

Linux Distros Unpatched Vulnerability : CVE-2026-57162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media...

CVE-2026-84901 Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...

WordPress Eventin plugin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability

Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.22...

CVE-2026-84901

The Eventin WordPress plugin (a.k.a. WP Event Solution) versions before 4.1.22 lack proper authorization checks on several event-management REST routes. Users with contributor-level access or above can change the site's front-page setting to an event they do not own and create, edit, or delete gl...

CVE-2026-53603

nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN, stored operator session tokens in plaintext in the operator_sessions table (the token column served as the PRIMARY KEY). Each token is a 32-byte random hex value delivered via cookie with a 24-hour validity. Unlike API keys and ...