CVE-2019-12409

CVE-2019-12409: Apache Solr में खराब डिफ़ॉल्ट कॉन्फ़िगरेशन के कारण RCE भेद्यता Apache Solr के 8.1.1 और 8.2.0 रिलीज़ में Solr के साथ शामिल डिफ़ॉल्ट solr.in.sh कॉन्फ़िगरेशन फ़ाइल में असुरक्षित सेटिंग मौजूद है। इस भेद्यता का कारण बनने वाली सेटिंग्स निम्नलिखित हैं: "solr.in.sh" में:...

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io: Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema Product: dgtlmoon/changedetection.io — v0.55.7 File: changedetectionio/api/Spec.py CWE: CWE-306 — Missing Authentication for Critical Function CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A...

CVE-2026-13714

root@kitploit: Realtyna WPL 5.3.0 - Unauthenticated RCE Exploit Description This exploit targets a critical vulnerability in Realtyna Organic IDX + WPL Real Estate plugin versions prior to 5.3.0. The plugin uses hardcoded credentials and allows unauthenticated file upload leading to Remote Code...

CVE-2026-75865 WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

CVE-2026-75865

WPLP Cookie Consent (a WordPress plugin for GDPR/CCPA consent management) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 4.4.1 . The root cause combines missing file type validation in the saas_upload_logo() function with an authorization bypass on the ...

CVE-2023-23752-Python

CVE-2023-23752-Python root@kitploit: usage: CVE-2023-23752.py -h url Joomla! 4.2.8 - Unauthenticated information disclosure positional arguments: url Root URL base path including HTTP scheme, port, and root folder options: -h, --help show this help message and exit...

CVE-2025-10230

CVE-2025-10230: Samba Critical RCE CVSS 10.0 Vulnerability Summary CVE-2025-10230 is a critical remote code execution RCE vulnerability that remained hidden in the Samba codebase for 13 years. The flaw resides in the handling of WINS Windows Internet Name Service registration packets. When...

Mitigate-CVE-2023-46747

Ansible Playbook to Mitigate CVE-2023-46747 K000137353: BIG-IP Configuration utility unauthenticated remote code execution vulnerability CVE-2023-46747 Here is the link https://my.f5.com/manage/s/article/K000137353 How to use it 1. Git clone my repo...

EUVD-2026-68929

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

CVE-2026-74837

CVE-2026-74837 is an unauthenticated denial-of-service vulnerability in ash-project ash_typescript (versions 0.1.0 before 0.18.0 ). The root cause lies in AshTypescript.FieldFormatter.convert_to_field_atom/2, which mints a permanent BEAM atom for every client-supplied RPC field name via String.to...

CVE-2026-74837 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

CVE-2026-82733 Route handler return value echoed into AshTypescript error response

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn, dispatch/3 i...

EUVD-2026-68928

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn, dispatch/3 i...

CVE-2026-82733 Route handler return value echoed into AshTypescript error response

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn, dispatch/3 i...

CVE-2026-82733

ash_typescript (ash-project) is vulnerable to Generation of Error Message Containing Sensitive Information in its typed-controller. When a route handler returns anything other than a %Plug.Conn{}, the dispatch/3 function in request_handler.ex passes the value to unexpected_return/2, which interpo...

CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

EUVD-2026-68925

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

CVE-2026-77950

ash_typescript (versions 0.8.0 through before 0.18.0) contains a fail-open flaw in its RPC error handling. The apply_error_handler/3 function in lib/ash_typescript/rpc/errors.ex is the sole hook for redacting or suppressing errors before they reach the client. Because error handlers are conventio...

CVE-2026-77856

ash_typescript (Elixir/BEAM library by ash-project) contains a resource-exhaustion flaw in resolve_typed_struct_field/2 within field_selector.ex. When a client-supplied field name on a typed struct field has no match in the reverse map, the code falls back to String.to_atom/1 before any field-exi...