Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

ownCloud Guests - User Enumeration

ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/email/token, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication. id:...

ResetNightmare

ResetNightmare Herramienta de prueba de concepto POC para ResetNightmare CVE-2026-27912. ResetNightmare es una falla de validación en el protocolo Kerberos de cambio de contraseña que permite restablecer la contraseña de cualquier cuenta de usuario/equipo objetivo, sin conocer la actual. El ataqu...

cve-2025-53779-kerberos_bypass_reproduction

CVE-2025-53779: Bypass de autenticación de Kerberos en Microsoft Windows Puntuación CVSS: 9.8 Crítica Estado: Explotación activa en el mundo real Divulgación: Microsoft Patch Tuesday de agosto de 2025 día cero Resumen CVE-2025-53779 es una vulnerabilidad crítica de bypass de autenticación en la...

AAMVA-PDF417-Vulnerability-Research

PDF417 身份证验证漏洞研究 概述 本仓库包含全面的安全研究，记录了影响政府身份证明、企业解决方案和消费类应用的 AAMVA 标准 PDF417 条码验证系统中的关键漏洞。研究包括一个功能完整的概念验证（PoC），展示了身份证验证系统在处理驾照条码时的系统性缺陷。 重要提示： 此代码仅供安全研究使用。有关允许的用途，请参阅 LICENSE.md 文件。 研究伦理声明 本研究遵循以下原则： 协调漏洞披露原则 120 天以上的厂商通知期（超过标准 90 天） 仅使用合成数据（无真实个人信息） 教育/防御性安全目的 ISO/IEC 29147 漏洞披露标准 通过 MITRE CVE 计划与...

CVE-2026-100693

Hugo versions v0.162.0 before v0.166.0 are affected by a case-sensitive validation flaw within the security.http.urls IP-literal deny rule. This vulnerability allows attackers to bypass security restrictions by using mixed-case URL schemes in resources.GetRemote calls to access restricted IP addr...

CVE-2026-100693 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...

PT-2026-99364

Name of the Vulnerable Software and Affected Versions Hugo versions 0.162.0 through 0.165.0 Description A case-sensitive validation flaw exists in the security.http.urls IP-literal deny rule. This allows attackers to bypass restrictions by using mixed-case URL schemes in resources.GetRemote calls...

PT-2026-97543

Name of the Vulnerable Software and Affected Versions automation-controller affected versions not specified Description An input-validation flaw exists in the sanitize jinja function. The function employs two regular expressions to reject user-supplied Jinja, but these patterns stop at the first...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: openldap (UTSA-2026-090503)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090503 advisory. libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even wh...

CVE-2026-90323 ublk: validate auto buf reg before taking uring_cmd

In the Linux kernel, the following vulnerability has been resolved: ublk: validate auto buf reg before taking uringcmd With UBLKFAUTOBUFREG, invalid sqe-addr can fail after ublkfilliocmd has set UBLKIOFLAGACTIVE. The uringcmd is completed while the tag stays active, which can hang teardown. Split...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in keras

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in keras Vulnerability Details CVEID:CVE-2026-11816 DESCRIPTION: Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in keras/src/utils/fileutils.py. T...

CVE-2026-65381

A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious app may be able to break out of its sandbox...

EUVD-2026-77939

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...

CVE-2026-43691

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...

CVE-2026-84618

A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...

CVE-2026-84618

A permissions issue in macOS allows an application to potentially access sensitive user data . The vulnerability is rooted in insufficient validation and has been addressed with improved validation measures. This flaw is fixed in macOS Golden Gate 27 , macOS Sequoia 15.8 , and macOS Tahoe 26.7 . ...

EUVD-2026-78020

A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to read arbitrary files...

CVE-2026-43692

A validation issue exists in macOS that can be exploited by a remote user to cause an unexpected app termination or arbitrary code execution . The root cause is addressed through improved input sanitization . This vulnerability is fixed in macOS Golden Gate 27 , macOS Sequoia 15.8 , and macOS Tah...

Astra Linux – Vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by an improper input validation vulnerability, which may lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a specially crafted file...