CVE-2026-55040

Microsoft SharePoint JWT 身份验证绕过（CVE-2026-55040） 概述 CVE-2026-55040.py 是一个概念验证（PoC）脚本，用于利用 SharePoint 身份验证绕过漏洞 CVE-2026-55040。 如需完整的技术分析，请参阅我们的 Rapid7 分析。 用法 root@kitploit: $ python CVE-2026-55040.py --help usage: CVE-2026-55040.py -h --target TARGET --host HOST --x5t X5T --realm REALM --sid SID...

CVE-2024-0044

CVE-2024-0044- CVE-2024-0044: a "run-as any app" high-severity vulnerability affecting Android versions 12 and 13 CVE-2024-0044 Exploit Script This Bash script demonstrates how to exploit CVE-2024-0044. For educational and testing purposes only. Prerequisites ADB Android Debug Bridge installed an...

EUVD-2026-70810

MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local...

Linux Distros Unpatched Vulnerability : CVE-2026-14199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key...

CVE-2026-14199

On instances using Auth Proxy header authentication auth.proxy with identity caching enabled syncttl 0, two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged...

CVE-2026-85430

MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local...

CVE-2026-85430 MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing

MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local...

CVE-2026-85430

MOOS essential-moos (through version 10.0.1) contains an authentication bypass in the pShare component, which accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. An unauthenticated network attacker can inject crafted messages into the local MOOS c...

CVE-2026-85430 MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing

MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local...

CVE-2026-14199

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

CVE-2026-14199 Session takeover via Auth Proxy cache key collision

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

CVE-2026-14199 Session takeover via Auth Proxy cache key collision

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

CVE-2026-14199

CVE-2026-14199 affects self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl > 0). The root cause is that the Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter , allowing distinct identities to co...

CVE-2026-84668

Jenkins SAML Plugin 4.618.v441a27fa46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user...

cve-2025-24054-lab

CVE-2025-24054 — Detection & Mitigation Lab Project log for a defensive security lab on CVE-2025-24054 , the Windows New Technology LAN Manager NTLM Hash Disclosure Spoofing vulnerability, under the assumption that the affected system cannot be patched short-term. Blue-team educational project...

CVE-2026-81777

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

CVE-2026-81777 WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

EUVD-2026-67656

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

CVE-2026-81777

Essential Addons for Elementor (WordPress plugin by WPDeveloper) versions up to and including 6.8.0 are affected by an Authentication Bypass by Spoofing vulnerability that enables Identity Spoofing . The issue was discovered by Gaurav popalghat and scored CVSS 5.3 (MEDIUM) , with a network attack...

CVE-2026-75020 Apache APISIX: ldap-auth plugin cross-subtree identity impersonation

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope...