CVE-2018-0114

CVE-2018-0114 Explotación de una vulnerabilidad en node-jose de Cisco, una biblioteca JavaScript creada para gestionar JWT. Esta vulnerabilidad en node-jose de Cisco permite a un atacante falsificar tokens maliciosos. JWT permite a los usuarios incrustar claves públicas usando el valor jwk dentro...

LEAKEY

LEAKEY 🔑 LEAKEY es una herramienta para la validación de tokens/claves API filtrados encontrados durante pruebas de penetración y compromisos de Red Team. El script es muy útil para Bug Hunters con el fin de validar y determinar el impacto de credenciales filtradas. LEAKEY utiliza un archivo de...

ownCloud Guests - User Enumeration

ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/email/token, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication. id:...

CVE-2025-50433

CVE-2025-50433 — Vulnerabilidad crítica de apropiación de cuentas que afecta a las plataformas Monnit Cloud .imonnit.com Resumen Existe una vulnerabilidad crítica de autenticación en .imonnit.com que permite la apropiación total de cuentas ATO en cualquier cuenta de usuario sin interacción de la...

CVE-2020-28874

Este repositorio contiene la descripción de la vulnerabilidad encontrada CVE-2020-28874 en ProjectSend versión r1270. Gracias a mis colegas de Entelgy Innotec Security por impulsarme a mejorar! CVE-2020-28874: Escalada de privilegios Descripción La vulnerabilidad se encuentra en el componente de...

CVE-2026-89542

A flaw was found in the Linux kernel's SUNRPC Sun Remote Procedure Call implementation. This vulnerability, located in the gsskrb5unwrapv2 function, arises when the system processes specially crafted short tokens or tokens with an invalid length. An attacker could exploit this by providing such a...

EUVD-2026-42963

ZITADEL: Missing Token Expiration exp Validation in JWT IdP Provider...

CVE-2026-89550

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: enforce krb5 token minimum length svcauthgssunwrappriv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gssunwrap: if len xdrstreamremainingxdr goto unwrapfailed;...

CVE-2026-68526

Concrete CMS before 9.5.3 is affected by a missing anti-CSRF token validation in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php), specifically in its submit() action. The action only checked canAccess() and the per-resource canAddCalendarEvent() pe...

CVE-2026-68526 Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

CVE-2026-89013

Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

CVE-2026-15710

An information leakage vulnerability exists in the Endpoint DLP component epdlpdrv.sys of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message...

CVE-2026-15710

CVE-2026-15710 affects the Endpoint DLP kernel driver (epdlpdrv.sys) of Netskope Client for Windows prior to version R141 . Two root causes enable the information leak: (1) the internal communication channel between the user-space hook DLL, the kernel driver, and the daemon lacked token-based mes...

EUVD-2026-76108

An information leakage vulnerability exists in the Endpoint DLP component epdlpdrv.sys of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message...

PT-2026-89873

An information leakage vulnerability exists in the Endpoint DLP component epdlpdrv.sys of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message...

EUVD-2026-75415

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from...

CVE-2026-78084

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...

CVE-2026-78084

SP Property (a Joomla extension by joomshaper.com) versions below 4.1.4 contain a Missing Access Control vulnerability in the gallery image management controller. The affected controller tasks lacked authorization checks and CSRF token validation , allowing users to invoke file removal actions wi...

CVE-2026-36956

CVE-2026-36956: Cross-Site Request Forgery CSRF en la Interfaz de Administración Web ID CVE: CVE-2026-36956 Fecha: 2026-04-29 Descubridor: Kirubel Solomne Proveedor: Shenzhen Dibit Network Equipment Co., Ltd. Producto: Dbit Router Versión de Firmware: V1.0.0 CWE: CWE-352 - Cross-Site Request...

CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation

CVE-2026-1529 Keycloak Exploit Tool Keycloak: Unauthorized organization registration via improper invitation token validation Disclaimer This tool is for educational and security testing purposes only. Use only on systems you have explicit permission to test. Unauthorized access to computer syste...