POC-CVE-2018-0114

POC-CVE-2018-0114 This repository contains the POC of an exploit for node-jose Stating from the last merge python lib: base64,urllib,rsa,sys Running the tests To run the script just run the following command: python jwk-node-jose.py "payload" key-size key-size whitout Authors Andrea Cappa -...

zeroscan

zeroscan Zeroscanは、ドメインコントローラの脆弱性スキャナで、現在Zerologon CVE-2020-1472、MS-PAR/MS-RPRN、SMBv2署名のチェックを含んでいます。 CVE-2020-1472: 組み込みスクリプトを使用してZerologon CVE-2020-1472をチェックしますが、ターゲットの悪用は試みず、単なる脆弱性スキャナです。 コードベースの借用元: https://github.com/SecuraBV/CVE-2020-1472 MS-PAR / MS-RPRN:...

Information Exposure

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Information Exposure via the Domains::get, Domains::listing, SubDomains::get, and SubDomains::listing API functions. An attacker can access DKIM private signing keys belonging to othe...

CVE-2026-100710 Froxlor before 2.3.12 DKIM Private Key Disclosure via API

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get, Domains::listing, SubDomains::get, and the admin branch of SubDomains::listing perform a wildcard SELECT over the paneldomains table and return the row unmodified, including the paneldomains.dkimprivkey...

UBUNTU-CVE-2026-67409

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CWE-252. the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response...

CVE-2026-90959 Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

CVE-2026-90959

A path traversal vulnerability exists in pulpcore within the content upload API's file_url parameter. The root cause is a validation mismatch: the system rejects URLs starting with file://, but Python's URL parser accepts the file: scheme without double slashes. This allows an authenticated user ...

CVE-2026-97055: Initialization of a Resource with an Insecure Default

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

CVE-2026-84716

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

SUSE CVE-2026-72793

SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with...

Linux Distros Unpatched Vulnerability : CVE-2026-52727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from...

CVE-2026-45726

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in...

DEBIAN-CVE-2026-52727

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...

CVE-2026-52727

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...

EUVD-2026-82369

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...

CVE-2026-52727

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...

CVE-2026-86824

The Newsletter WordPress plugin (versions before 9.3.8 ) is vulnerable to unauthenticated subscriber PII disclosure and modification . The root cause is the failure to generate an email tracking signing key with sufficient entropy, combined with the use of an unkeyed hash to sign tracking links. ...

CVE-2026-52727: Use of Hard-coded Cryptographic Key

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...

polaris v10.2.3

Polaris is an open source policy engine for Kubernetes Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the...

CVE-2026-92794

OpenSign through version 2.41.3 is affected by an information disclosure vulnerability in the getDocument cloud function. When one-time-password (OTP) verification is disabled, the function fails to validate caller identity, allowing unauthenticated attackers to supply a document identifier obtai...