CVE-2026-63104

Kaneo versions 2.3.12 before 2.12.2 are vulnerable to a missing authorization flaw in the bulk task endpoint . While the system verifies workspace membership, it fails to invoke the role-based permission checks required for other task endpoints. Authenticated workspace members with viewer or memb...

CVE-2026-63104 Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-63104 Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2021-33699_Task_Hijacking

CVE-2021-33699TaskHijacking ¿Qué es? Una aplicación atacante y una aplicación víctima para practicar la vulnerabilidad CVE-2021-33699 Task Hijacking. Referencia https://naro-security.tistory.com/55...

CVE-2023-31705

CVE-2023-31705 descripción Una vulnerabilidad de Cross-site scripting XSS reflejado en Sourcecodester Task Reminder System 1.0 permite a un usuario autenticado inyectar JavaScript malicioso en el parámetro page. Tipo de vulnerabilidad Cross Site Scripting XSS Proveedor del producto Sourcecodster...

ctf-cve-2019-11043

Aplicación de Gestión de Tareas Laboratorio CVE-2019-11043 Aplicación PHP mínima con configuración Nginx/PHP-FPM intencionalmente vulnerable para reproducir CVE-2019-11043. Incluye un pequeño gestor de tareas, login/administrador y una interfaz de configuración de la base de datos. Compilar y...

PageBuilderCK-CVE-2026-56290-Exploit

Page Builder CK — fonts.save RCE Probe CVE-2026-56290 BlackHat Team proof-of-concept scanner for the Joomla Page Builder CK fonts.save vulnerability. POC CVE-2026-56290 Author: @mrzblackhat Team: BlackHat Team Credits: Peyman Siyahi · MR.PERSIA Overview This tool probes Joomla sites running the...

CVE-2025-60710

CVE-2025-60710 Este es un PoC para la vulnerabilidad de escalada de privilegios local en la tarea programada \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration. Cuando se inicia esta tarea programada, el proceso taskhostw.exe intentará abrir el directorio...

CVE-2026-63104: Missing Authorization

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-94625

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...

CVE-2025-60710

CVE-2025-60710 Este es un PoC para la vulnerabilidad de escalada de privilegios local en la tarea programada \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration. Cuando se inicia esta tarea programada, el proceso taskhostw.exe intentará abrir el directorio...

CVE-2026-94625 vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...

CVE-2026-94625 vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...

CVE-2026-27495

CVE-2026-27495 — Escape de sandbox en el Task Runner de JS de n8n Escape de sandbox en el Task Runner de JavaScript de n8n mediante una fuga de objetos del host-realm...

CVE-2026-63342

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

CVE-2026-84298 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied taskexternalid values in the durableInvocations routing map before tenant ownership is verified, and callback delivery...

CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

CVE-2026-43499

CVE-2026-43499 Notas de Explotación Gravedad: ALTA CVSS: 7.8 Impacto: Confidencialidad, Integridad, Disponibilidad Publicado: 2026-05-21 Resumen Técnico CVE-2026-43499 es una vulnerabilidad en el kernel de Linux, que afecta específicamente al componente rtmutex, encargado de gestionar los bloqueo...

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

Cybersecurity researchers have disclosed details of a new campaign dubbed TASKSTOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts. The backdoor "automatically harvests and exfiltrates business documents, watches the filesystem for new files in real...

CVE-2011-3192

CVE-2011-3192 Ejecútalo usando Python 3.7 o 3.10 probado en ellos 1. git clone https://github.com/futurezayka/CVE-2011-3192.git 2. cd ./CVE-2011-3192 3. pip install -r requirements.txt 4. python3 exploit.py host tasks ejemplo python3 exploit.py https://example.com 50...