CVE-2026-77557

CVE-2026-77557 is a critical (CVSS 9.8) Improper Access Control vulnerability in UniFi Protect AI Key . A malicious actor with network access can exploit it to escalate privileges on the device, with no prior authentication required (PR:N). The attack vector is network-based with low complexity, ...

CVE-2026-80204 Grav before 1.0.18 Authentication Bypass via Scoped API Key

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

CVE-2026-80204

CVE-2026-80204 affects the Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 . The root cause lies in the injectSecurityTab() function of BlueprintController, which performs raw isSuperAdmin()/hasPermission() checks without a request parameter, preventing enforcement of scopeAllows(). As a ...

EUVD-2026-66395

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

EUVD-2026-66394

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...

CVE-2026-80203

The getgrav/grav-plugin-api plugin before 1.0.18 contains an authentication bypass in the requireNotSuperTarget() function within UsersControllers.php, affecting seven sensitive user-management endpoints. The root cause is that the scope check calls isSuperAdmin() on the acting account rather tha...

CVE-2021-40444

CVE-2021-40444 CVE-2021-40444 POC -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAu0enjPUx4R0+zWyY4FEI 0LUeiAJecPz6iDPdMRiIQHBPZBxKH7A+losAu7DB9IoY1GnGvFJzA1G4UkK6n/rg 2r65Ym3SloHoov/IxC2qcyz1UBftD0HBR8KE9Yy84k1sYIdNzKeWPQETY9UqEEy/...

WordPress MalCare WordPress Security plugin 5.16-6.62 - Unauthenticated Site Takeover via Connection Key Recovery vulnerability

Unauthenticated Site Takeover via Connection Key Recovery vulnerability discovered by Jakub Herman in WordPress Plugin MalCare Security versions 5.16-6.62...

WordPress BlogVault Backup & Staging plugin 5.16-6.62 - Unauthenticated Site Takeover via Connection Key Recovery vulnerability

Unauthenticated Site Takeover via Connection Key Recovery vulnerability discovered by Jakub Herman in WordPress Plugin BlogVault versions 5.16-6.62...

WordPress The WP Remote WordPress plugin 5.16-6.62 - Unauthenticated Site Takeover via Connection Key Recovery vulnerability

Unauthenticated Site Takeover via Connection Key Recovery vulnerability discovered by Jakub Herman in WordPress Plugin The WP Remote WordPress Plugin versions 5.16-6.62...

CVE-2026-19197

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

Alibab-Nacos-Unauthorized-Reset-PWD

Auswirkungen der Schwachstelle In Nacos wurde eine Schwachstelle entdeckt, die Nacos = 2.2.0 betrifft. Wenn ein Benutzer den standardmäßigen JWT-Schlüssel verwendet, kann ein Angreifer das Passwort eines beliebigen Benutzers zurücksetzen und das Benutzerkonto übernehmen. Betroffenes Produkt...

cve-2020-0601_poc

Informazioni di base Il codice sorgente di questo strumento è pensato per aiutare a comprendere la vulnerabilità CVE-2020-0601 scoperta nella Windows Crypto API, vedere panoramica del CERT. Lo strumento stesso può essere utilizzato per produrre un certificato per un dominio arbitrario che sarà...

RAMnesia-Attack

Questa ricerca presenta un'analisi completa di due classi critiche di attacchi alla memoria hardware dei moderni sistemi informatici che utilizzano memoria DDR5: Phoenix Rowhammer Attack CVE-2025-6202 e Attacco RAMnesia CVE-2023-39910 . Entrambi gli attacchi dimostrano vulnerabilità fondamentali...

lehack-2026-challenge

LeHack 2026 Challenge Eine 3-stufige Challenge, die die Auswirkungen des direkten Einhängens von Datenträgern demonstriert. Challenge-Übersicht Ebene| Ziel| Technik ---|---|--- 1| Zugriff auf den unverschlüsselten Datenträger| Boot-Cmdline in grub auf init=/bin/bash setzen 2| LUKS von vault1...

CVE-2021-21239

Technischer Bericht zu CVE-2021-21239: SAML-Authentifizierungsschwachstelle in Redash Einführung in SAML Security Assertion Markup Language SAML ist ein offener Standard für den Austausch von Authentifizierungs- und Autorisierungsdaten zwischen Parteien in einem föderierten Identitätssystem. Er...

CVE-2025-59528

Version francaise CVE-2025-59528 Prova di Concetto PoC minimo focalizzato sulla validazione tecnica della vulnerabilità in un ambiente autorizzato. Prerequisiti Devi avere un account utente sul dashboard Flowise di destinazione. Devi avere una chiave API valida collegata a quell'account. Devi...

ed25519-unsafe-libs

ed25519-unsafe-libs Attacco Oracle alla Funzione di Firma Ed25519 con Doppia Chiave Pubblica Un elenco di librerie di firma ed25519 potenzialmente non sicure che espongono un'API pubblica in cui chiave segreta e chiave pubblica possono essere fornite indipendentemente come input della funzione di...

tinydtls

CONTENUTI Questa libreria contiene funzioni e strutture che possono aiutare a costruire un server UDP monothread con supporto DTLS in C99. Sono disponibili i seguenti componenti: dtls Supporto di base per DTLS con modalità chiave pre-condivisa. tests La sottodirectory tests contiene programmi di...

Laravel-CVE-2018-15133

CVE-2018-15133 - Vulnerabilità di unserializzazione di Laravel APPKEY WhiteHat School 3ª generazione, classe 28, Lee Yebin - Virtualizzazione: configurazione Docker vulnerabile https://github.com/yeahhbean/Laravel-CVE-2018-15133 Panoramica Questo progetto è un ambiente basato su Docker, allestito...