CVE-2026-84804 Kimai before 2.65.0 Authorization Bypass via Team Activity API

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...

CVE-2026-84804 Kimai before 2.65.0 Authorization Bypass via Team Activity API

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...

CVE-2026-84699

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...

CVE-2026-84699 Team Password Manager before 14.184.308 Authentication Bypass in Password Reset

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...

EUVD-2026-69790

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...

CVE-2026-84699

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow, allowing unauthenticated attackers to reset local account passwords and authenticate as those users, resulting in unauthorized access. The vulnerability is rated CVSS 3.1...

PT-2026-84578

Name of the Vulnerable Software and Affected Versions Team Password Manager versions prior to 14.184.308 Description An issue exists where the software fails to enforce authentication requirements during the local account password reset flow. This allows unauthenticated attackers to reset local...

MemShellParty v2.10.0

MemShellParty 中文 | English !WARNING This tool is intended only for security researchers, network administrators, and related technical personnel for authorized security testing, vulnerability assessment, and security auditing. Using this tool for any unauthorized network attack or penetration tes...

EUVD-2026-66224

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...

Red-Team-Management

Red-Team-Assessment Important documents for you to start a Red Team management Tools Law Suit Methodologies Tips and Tricks Created by Joas Antonio Reference: Red Team Guide and Red Team Operations & Development...

onecli v2.0.1

The agent harness built for teams. A pro assistant for companies. Give every employee a secured, sandboxed personal agent. Website · Docs · Discord Quick Start Cloud-hosted: onecli.sh Self-hosted root@kitploit: git clone https://github.com/onecli/onecli.git && cd onecli pnpm install pnpm run setu...

CVE-2026-82279

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

EUVD-2026-66713

Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project...

CVE-2026-82279 HyperDX Team Management Operations Missing Role-Based Access Control

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

EUVD-2026-67810

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

CVE-2026-82279

HyperDX through version 1.10.1 fails to enforce role-based access control on team management endpoints, allowing any authenticated team member (low privileges) to perform administrative actions. Specifically, requests to PATCH /team/apiKey , PATCH /team/name , and DELETE /team/member can be used ...

CVE-2026-82279 HyperDX Team Management Operations Missing Role-Based Access Control

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

CVE-2026-55228

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning...

CVE-2026-61790 Weblate: Team-enforced 2FA is bypassed for global permissions

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global...

CVE-2026-55228

Weblate versions prior to 2026.7 contain a WebIDOR (Insecure Direct Object Reference) vulnerability in the GroupViewSet REST API endpoint. The API did not properly enforce the scope of project- and workspace-scoped teams, allowing an authenticated user with project-manager privileges to submit un...