cve-2026-41042

CVE-2026-41042 : Apache Gravitino 1.2.1 RCE non authentifié Preuve de concept autonome, utilisant uniquement la bibliothèque standard, pour CVE-2026-41042 : exécution de code à distance non authentifiée dans Apache Gravitino avant 1.2.1 via le paramètre de connexion INIT de JDBC H2. Pas d'en-tête...

CVE-2019-12409

CVE-2019-12409: Vulnérabilité RCE due à une mauvaise configuration par défaut dans Apache Solr Les versions 8.1.1 et 8.2.0 d'Apache Solr contiennent un paramètre non sécurisé dans le fichier de configuration par défaut solr.in.sh fourni avec Solr. Les paramètres qui conduisent à cette vulnérabili...

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io : Authentification manquante sur /api/v1/full-spec divulgue le schéma OpenAPI complet Produit : dgtlmoon/changedetection.io — v0.55.7 Fichier : changedetectionio/api/Spec.py CWE : CWE-306 — Authentification manquante pour une fonction critique CVSS 3.1 :...

CVE-2026-13714

Realtyna WPL 5.3.0 - Exploit RCE non authentifié Description Cet exploit cible une vulnérabilité critique dans le plugin Realtyna Organic IDX + WPL Real Estate dans les versions antérieures à 5.3.0. Le plugin utilise des identifiants codés en dur et permet un téléversement de fichiers non...

CVE-2026-75865 WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

CVE-2026-75865

WPLP Cookie Consent (a WordPress plugin for GDPR/CCPA consent management) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 4.4.1 . The root cause combines missing file type validation in the saas_upload_logo() function with an authorization bypass on the ...

CVE-2023-23752-Python

CVE-2023-23752-Python root@kitploit: usage: CVE-2023-23752.py -h url Joomla! 4.2.8 - Unauthenticated information disclosure positional arguments: url Root URL base path including HTTP scheme, port, and root folder options: -h, --help show this help message and exit...

CVE-2025-10230

CVE-2025-10230 : RCE critique Samba CVSS 10.0 Résumé de la vulnérabilité La CVE-2025-10230 est une vulnérabilité critique d'exécution de code à distance RCE qui est restée cachée dans la base de code de Samba pendant 13 ans. Le défaut réside dans le traitement des paquets d'enregistrement WINS...

Mitigate-CVE-2023-46747

Playbook Ansible pour atténuer CVE-2023-46747 K000137353: vulnérabilité d'exécution de code à distance non authentifiée dans l'utilitaire de configuration BIG-IP CVE-2023-46747 Voici le lien https://my.f5.com/manage/s/article/K000137353 Comment l'utiliser 1. Git clone mon dépôt...

EUVD-2026-68929

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

CVE-2026-74837

CVE-2026-74837 is an unauthenticated denial-of-service vulnerability in ash-project ash_typescript (versions 0.1.0 before 0.18.0 ). The root cause lies in AshTypescript.FieldFormatter.convert_to_field_atom/2, which mints a permanent BEAM atom for every client-supplied RPC field name via String.to...

CVE-2026-74837 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

CVE-2026-82733 Route handler return value echoed into AshTypescript error response

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn, dispatch/3 i...

EUVD-2026-68928

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn, dispatch/3 i...

CVE-2026-82733 Route handler return value echoed into AshTypescript error response

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn, dispatch/3 i...

CVE-2026-82733

ash_typescript (ash-project) is vulnerable to Generation of Error Message Containing Sensitive Information in its typed-controller. When a route handler returns anything other than a %Plug.Conn{}, the dispatch/3 function in request_handler.ex passes the value to unexpected_return/2, which interpo...

CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

EUVD-2026-68925

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

CVE-2026-77950

ash_typescript (versions 0.8.0 through before 0.18.0) contains a fail-open flaw in its RPC error handling. The apply_error_handler/3 function in lib/ash_typescript/rpc/errors.ex is the sole hook for redacting or suppressing errors before they reach the client. Because error handlers are conventio...