nagiosxi-root-rce-exploit

nagiosxi-root-exploit Обзор В Nagios XI = 5.6.5 существует уязвимость, позволяющая злоумышленнику использовать RCE для повышения привилегий до root. Для эксплуатации требуется доступ к серверу под пользователем 'nagios' или доступ к CCM через веб-интерфейс с правами на управление плагинами. Детал...

Nagios-CVE-2019-15949-RCE

Nagios-CVE-2019-15949-RCE-Poc un PoC Python per la CVE-2019-15949 Panoramica Esiste una vulnerabilità in Nagios XI = 5.6.5 che consente a un attaccante di sfruttare una RCE per elevare i privilegi a root. L'exploit richiede l'accesso al server come utente 'nagios', oppure l'accesso CCM tramite...

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

CVE-2026-42008

CVE-2026-42008 is an authentication bypass in Dovecot (Open-Xchange fork) where forwarding information from a trusted proxy host is not kept separate from Dovecot's own authentication fields. A malicious or compromised trusted proxy host can inject an internal authentication field, allowing it to...

legion

Legion ZK Auth 🛡️ Echte Zero-Knowledge-Authentifizierung mit hardwaregebundenen Geräte-Ringsignaturen 🎯 Was ist Legion? Legion ist ein passwortloses Zero-Knowledge-Authentifizierungssystem , das nachweist, dass Sie autorisiert sind, ohne zu verraten, wer Sie sind. Authentifizieren Sie sich nur mit...

CVE-2023-22809

CVE-2023-22809 Analisi & Exploit Informazioni di base ID vulnerabilità: CVE-2023-22809 Livello di gravità: Alto Punteggio: 7.8 Versioni interessate: sudo 1.8.0-sudo 1.9.12p1sudo=1.8.0 or sudo =1.9.12p1 Effetto dell'attacco: Escalation dei privilegi locale Tecnica di attacco Modificare /etc/passwd...

CVE-2026-62862

Typebot (open-source chatbot builder), self-hosted versions ≤ 3.17.1 , is vulnerable to account takeover via brute-forcing of the passwordless email magic-link login code. The root cause is a 6-digit code generated with Math.random() (only 900,000 combinations) with a 10-minute expiry, no attempt...

CVE-2026-62862 TypeBot: Account takeover via brute-forceable 6-digit magic-link code

Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...

CVE-2026-59808

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...

EUVD-2026-64266

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...

kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

CVE-2026-73420 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

CVE-2026-73532

Fluent Forms Pro 6.2.7 is affected by an embedded malicious-code vulnerability introduced via a tampered plugin build served from a decommissioned update server. A rogue PHP file, libs/class-license-sync.php, was loaded through a require_once in fluentformpro.php, creating a backdoor REST API end...

EUVD-2026-58112

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

CVE-2026-73533

CVE-2026-73533 affects Ninja Tables Pro 5.2.11. The vulnerability is an embedded malicious code issue introduced via a tampered plugin build served through a decommissioned update server. A rogue file, app/Library/updater/NinjaTableDataSync.php, creates a backdoor REST API endpoint and drops pers...

PT-2026-71689

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a require once directive added to fluentformpro.php...

AZL-95928 CVE-2026-72693 affecting package kbd 2.2.0-2

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

DEBIAN-CVE-2026-72693

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

UBUNTU-CVE-2026-72693

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...