CVE-2026-110907

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string like node:title or user:name used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit...

OneDev < 4.0.3 - User Access Token Leak

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. id: CVE-2021-21246...

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

D-Link D-View 8 v2.0.1.28 - Authentication Bypass

Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28 id: CVE-2023-5074 info: name: D-Link D-View 8 v2.0.1.28 - Authentication Bypass author: DhiyaneshDK severity: critical description: | Use of a static key t...

Flowise <= 3.0.5 - Account Takeover

Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts. id: CVE-2025-58434 info: name: Flowise = 3.0.5 - Account Takeover author:...

Langflow AI <= 1.6.9 - CORS Misconfiguration

Langflow AI versions 1.6.9 and earlier are vulnerable to a CORS misconfiguration that allows any origin to make credentialed requests. Combined with SameSite=None cookies, this enables cross-origin token theft and subsequent remote code execution via the /api/v1/validate/code endpoint. id:...

Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

invoker

Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...

CLEANSTART-2026-YV89113 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

CVE-2025-22868 affects multiple packages. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. See references for individual vulnerability details...

EUVD-2026-101729

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, runnin...

EUVD-2026-101718

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

GitLab 19.1 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-78335)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...

CVE-2019-19609

CVE-2019-19609 Strapi Framework Vulnerable to Remote Code Execution well, I didnt found any exploit for CVE-2019-19609 so I wrote one. :/ Usage python3 exploit.py A video https://youtu.be/alhZJmuUd2s More Information https://hack-fast.herokuapp.com/cve/CVE-2019-19609...

CVE-2026-110846 n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, runnin...

CVE-2026-110835

FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to HTTP header injection within their proxy functionality. The root cause is the failure to reject a lone LF character in the target portion of a routing token (specifically Cookie: msts= ). This allows the http_proxy_connect function to write t...

CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-34990

CVE-2026-34990 — CUPS local privilege escalation cups2root, de-harnessed CVSS 3.x : 8.4 HIGH approx — verify CWE : CWE-287 Improper Authentication + CWE-269 Improper Privilege Mgmt Fix : CUPS 2.4.17+ Affects : CUPS ≤ 2.4.16 with cupsd running as root and 631 reachable locally Local privilege...

cups-2.4.16-lpe

CUPS 2.4.16 — Local Privilege Escalation CVE-2026-34990 📋 Summary CUPS 2.4.16 contains a local privilege escalation vulnerability also tracked as GHSA-c54j-2vqw-wpwp. The Vulnerability 1. World-writable socket — /run/cups/cups.sock is world-writable, allowing any local user to send IPP requests t...