CVE-2023-27524

CVE-2023-27524: Apache Superset 認証バイパス Apache Superset サーバーが安全でないデフォルト設定（CVE-2023-27524）で実行されているかどうかを確認するスクリプト。このスクリプトは、Superset サーバーのセッションクッキーが既知のデフォルトの Flask SECRETKEY で署名されているかどうかをチェックします。 --validate フラグを使用すると、Superset API を使用してデータベースを列挙し、悪用可能性を検証できます。 ブログ記事 詳細はこちら：...

osCommerce 2.3.4.1 - Remote Code Execution

osCommerce Online Merchant 2.3.4.1 contains a remote code execution caused by insecure default configuration and missing authentication in the installer workflow, letting unauthenticated attackers execute arbitrary PHP code via install4.php, exploit requires accessible /install/ directory after...

firebaseExploiter

Insecure Firebase CLI Scanner & Exploit. Features • Install • Usage Features Mass vulnerability scanning from list of hosts Custom JSON data in exploit.json to upload during exploit Custom URI path for exploit Usage This will display help for the CLI tool. Here are all the required arguments it...

sjet

sJET by siberas siberas JMX Exploitation Toolkit sJET allows an easy exploitation of insecure configured JMX services. Additional background information can be found here and here. Prerequisites Jython 2.7 Usage SJET implements a CLI interface using argparse: root@kitploit: jython sjet.py...

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

CVE-2026-84835

Missing Authorization vulnerability in DimaFreund Rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rentsyst: from n/a through 2.1.2...

CVE-2023-27524-POC

CVE-2023-27524: Apache Superset Bypass dell'autenticazione Script per verificare se un server Apache Superset è vulnerabile a CVE-2023-27524 e, se è vulnerabile, forgiare un cookie di sessione con userid = 1, che di solito è l'utente admin, consentendo il bypass dell'autenticazione e l'accesso al...

EUVD-2026-67029

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...

CVE-2026-76244 stigmem-node Insecure Federation Transport Configuration

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation...

CVE-2026-62415

Affected software: Joomla extension Membership Pro (Joomla) prior to version 4.6.2. Issue: default configuration allowed unauthenticated users to upload media assets, enabling potential unauthorized media uploads. No further details on impact, exploit, or fixes are provided in the supplied docume...

PYSEC-2026-2759 Open WebUI: Stored XSS in Mermaid Markdown Preview

Summary Open WebUI renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using innerHTML. Because Mermaid is configured with securityLevel: 'loose', attacker-controlled Mermaid content can be rendered unsafely in this flow. A working paylo...

PT-2026-78422

Name of the Vulnerable Software and Affected Versions stigmem-node version 0.9.0a1 Description Plugin signature enforcement can be disabled using a single configuration flag without requiring a second explicit acknowledgment. In environments where plugin directories are writable by less-trusted...

CVE-2026-2264

CVE-2026-2264 describes a vulnerability in Google Cloud Apigee SetIntegrationRequest policy enabling remote SSRF and exfiltration of service account tokens. Exploitation required an insecure API proxy configuration; CVSS metrics indicate network access with low complexity, no privileges, and high...

GHSA-VMM5-FJGX-2JHP Apache CXF's WS-Transfer module has an insecure XML parser configuration

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

EUVD-2026-31434

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

Anthropic Claude Code < 2.1.75 Local Privilege Escalation via Insecure Configuration Loading (CVE-2026-35603)

The version of Anthropic Claude Code installed on the remote Windows host is prior to 2.1.75. It is, therefore, affected by a local privilege escalation vulnerability. On Windows, Claude Code loaded system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without...

CVE-2025-31973

HCL BigFix Service Management SM is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introduce known vulnerabilities, potentially increasing the risk of exploitation in the application environment...

PT-2026-42189

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description The OIDC authentication plugin allows automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account lacks a stored sub value. In scenari...

Zyxel WRE6505 安全漏洞

The Zyxel WRE6505 is a wireless signal expansion device produced by the Chinese company Zyxel. The Zyxel WRE6505 v2 V1.00ABDV.3C0 version contains a security vulnerability. This vulnerability stems from the insecure storage of sensitive information in the configuration file, which may allow local...

PT-2026-38434

Name of the Vulnerable Software and Affected Versions Optoma CinemaX P2 version TVOS-04.24.010.04.01 Description The device exposes Android Debug Bridge ADB on TCP port 5555 over the network without authentication. It is configured with the variable ro.adb.secure set to 0, which disables RSA key...