Lucene search
+L

103 matches found

Nuclei
Nuclei
added 10 hours ago137 views

Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass

An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled. id: CVE-2020-13125 info...

9.9CVSS7.4AI score0.08565EPSS
SaveExploits1References2
Nuclei
Nuclei
added 10 hours ago77 views

Zitadel - User Registration Bypass

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the...

7.5CVSS7.5AI score0.02518EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2 days ago19 views

CVE-2026-46482 MyBB: Security Question insufficient validation

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

5.3CVSS0.00328EPSS
SaveExploits0References4
NVD
NVD
added 2 days ago5 views

CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

7.7CVSS0.00172EPSS
SaveExploits0References2
CVE
CVE
added 2 days ago9 views

CVE-2026-50575

BetterDesk versions through 2.3.0 fail to invalidate deleted device identities, letting an unauthenticated client replay or spoof a device ID to bypass registration controls. CVSS 7.7 (HIGH) reflects network exposure with no privileges required. Version 3.0.0-alpha patches the issue; no workaroun...

7.7CVSS5.3AI score0.00172EPSS
SaveExploits0References2
OSV
OSV
added 2 days ago2 views

CVE-2026-50575 BetterDesk has a replay behavior vulnerability when devices are deleted

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

7.7CVSS5.5AI score
SaveExploits0References4
EUVD
EUVD
added 2 days ago6 views

EUVD-2026-60763

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

7.7CVSS5.4AI score0.00172EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2 days ago5 views

CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

7.7CVSS5.3AI score0.00172EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 2 days ago21 views

CVE-2026-50575 BetterDesk has a replay behavior vulnerability when devices are deleted

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

7.7CVSS0.00172EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/25 10:45 a.m.11 views

CVE-2026-66013

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

9.3CVSS5.9AI score0.00388EPSS
SaveExploits0References3
CNVD
CNVD
added 2026/07/24 12:0 a.m.7 views

Apache Fury deserialization vulnerability (CNVD-2026-30659)

Apache Fury is a high-performance serialization framework that supports multiple languages such as Java and C++. It is widely used in distributed systems and message queues to handle cross-language or cross-process data exchanges. Before version 1.4.0, Apache Fury had a deserialization...

9.8CVSS5.9AI score0.00634EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/07/21 10:43 a.m.8 views

CVE-2026-64606

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the...

9.8CVSS5.2AI score0.00634EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/21 10:43 a.m.32 views

CVE-2026-64606

CVE-2026-64606 describes a deserialization of untrusted data issue in Apache Fory prior to 1.4.0, where Java lambda deserialization may bypass class-registration checks, affecting the lambda capture class. The vulnerability pattern is a risk to confidentiality, integrity, and availability (per th...

9.8CVSS5.3AI score0.00634EPSS
SaveExploits0References2Affected Software1
Vulnrichment
Vulnrichment
added 2026/07/08 12:20 a.m.5 views

CVE-2026-55432 Coder's sub-agent app registration bypasses template port-sharing policy enforcement

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a...

5.4CVSS6AI score0.00181EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/07 4:41 p.m.17 views

GO-2026-5926 Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder...

5.4CVSS5.9AI score0.00181EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/04 5:16 p.m.23 views

CVE-2026-50076

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via...

9.1CVSS0.0052EPSS
SaveExploits0References2
OSV
OSV
added 2026/05/19 9:31 a.m.12 views

GHSA-G8VR-X4QH-25QG Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation

A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction fails to validate that the newly created credential's parameters, such as public key...

4.3CVSS5.7AI score0.00392EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/05/14 12:0 a.m.21 views

PT-2026-40894

Name of the Vulnerable Software and Affected Versions User Registration & Membership plugin for WordPress versions prior to 5.1.6 Description An issue exists where the is admin creation process function relies exclusively on the presence of the action=createuser parameter within the $ REQUEST...

5.3CVSS5.8AI score0.00445EPSS
SaveExploits1References4
CVE
CVE
added 2026/05/04 6:28 p.m.50 views

CVE-2026-42230

Affected software: n8n open source workflow automation platform. Vulnerability: Open redirect via the MCP OAuth flow. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /mcp-oauth/register endpoint allowed unauthenticated OAuth client registrations, enabling arbitrary redirect_uri values. If a u...

6.1CVSS5.9AI score0.00181EPSS
SaveExploits0References1Affected Software1
Positive Technologies
Positive Technologies
added 2026/03/04 12:0 a.m.16 views

PT-2026-23106

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.12.0 Description ZITADEL, an open source identity management platform, had a flaw in its login V2 UI. This allowed users to circumvent login behavior and security policies, enabling self-registration of new...

8.2CVSS5.8AI score0.00312EPSS
SaveExploits0
Rows per page
Query Builder