932 matches found
CVE-2023-27524
CVE-2023-27524 Apache Superset Auth Bypass CVE-2023-27524 Reference https://nvd.nist.gov/vuln/detail/CVE-2023-27524 https://github.com/horizon3ai/CVE-2023-27524 https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/...
CVE-2026-23744
CVE-2026-23744: Unauthenticated Remote Code Execution in @mcpjam/inspector DISCLAIMER: This repository and the associated scripts are intended solely for authorized security assessments, penetration testing, security research, and educational analysis. Unauthorized testing of systems without...
CVE-2023-27524
CVE-2023-27524 Insecure Default Configuration in Apache Superset Leads to Remote Code Execution Screenshot Requirements Python3.7+ Supported Os Linuxer Wingays Get start with $ git clone https://github.com/Pari-Malam/CVE-2023-27524 $ cd CVE-2023-27524 $ pip/pip3 install -r requirements.txt $...
CVE-2026-59596
In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
CVE-2026-59596
A vulnerability exists in multiple functions of mpu.c within a security coprocessor. Due to an insecure default value , it is possible to execute code from non-secure memory. This flaw allows for local escalation of privilege without requiring additional execution privileges or user interaction. ...
CVE-2026-59596
In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
CVE-2026-59596: Google Android: In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security…
In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
PT-2026-144548
In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
CVE-2026-94460
IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality...
CVE-2026-94460 IRISPowerscan Insecure default privilege assignment for installation account
IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality...
EUVD-2026-116800
IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality...
CVE-2026-112255
Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix for...
CVE-2026-112255
OpenText Advanced Authentication Server is vulnerable to an insecure default configuration issue (CWE-1188) affecting versions 6.4.0.0 through 6.4.3.x , 6.5.0.0 through 6.5.0.x , and 6.6.0.0 through 6.6.1.0 . The root cause is an insecure default allow-list that permits Excessive Allocation of re...
CVE-2026-112255 Endpoint credential minting (insecure default allow-list)
Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix for...
Insecure Default Initialization of Resource
Overview @storybook/core is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved project config when usi...
Insecure Default Initialization of Resource
Overview @storybook/addon-vitest is a Storybook Vitest addon: Blazing fast component testing using stories Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not...
Insecure Default Initialization of Resource
Overview @storybook/addon-mcp is a Help agents automatically write and test stories for your UI components Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not...
A2A Java SDK has a fail-open default task authorization
Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...
GHSA-QW47-MCM5-934W A2A Java SDK has a fail-open default task authorization
Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...
CVE-2026-77936 Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access
Letta through 0.16.8 ships a compose.yaml that does not enable LETTASERVERSECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST...