CVE-2026-115214

The Datawiza Proxy Auth Plugin for WordPress, in versions before 1.1.1 , is vulnerable to unauthenticated privilege escalation. The plugin fails to verify that the user-identity and role HTTP request headers it trusts actually originate from a trusted reverse proxy. This flaw allows an unauthenti...

CVE-2026-108548

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's authhandler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-...

CVE-2026-108548

AstronRPA versions through 1.1.6 are vulnerable to an authentication bypass due to a flaw in the OpenResty gateway's auth_handler.lua component. The system fails to validate Bearer tokens , allowing unauthenticated attackers to provide arbitrary values to access the /api/resource/ and /api/rpa-ai...

CVE-2026-108548 AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's authhandler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-...

User Impersonation

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to User Impersonation via the wsterminal process. An attacker can gain unauthorized access to another user's terminal session by injecting crafted values into the sessionid parameter, causing the backend to...

CVE-2026-59224

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/openwebui/routers/terminals.py built the wsterminal upstream URL from an unencoded sessionid and appended userid as a query parameter, allowing query injection to make the terminal backe...

CVE-2026-59224: Improper Authentication

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/openwebui/routers/terminals.py built the wsterminal upstream URL from an unencoded sessionid and appended userid as a query parameter, allowing query injection to make the terminal backe...

CVE-2026-26342 Tattile Smart+ / Vega / Basic <= 1.181.5 Insufficient Session Token Expiration

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token X-User-Token with insufficient expiration. An attacker who obtains a valid token for example via interception, log exposure, or token reuse on a shared system can continue to...

CVE-2026-26342: Insufficient Session Expiration

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token X-User-Token with insufficient expiration. An attacker who obtains a valid token for example via interception, log exposure, or token reuse on a shared system can continue to...

CVE-2024-21622

Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensu...

CVE-2020-35666

Steedos Platform (until version 1.21.24) is affected by a NoSQL injection in the /api/collection/findone handler. The underlying issue is inadequate validation of req.body in server/packages/steedos_base.js, which can be exploited using MongoDB operators (e.g., X-User-Id[$ne]=1) to influence quer...

CVE-2020-35666: Improper Neutralization of Special Elements used in an SQL Command

Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedosbase.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id$ne=1 value...

os-x/PPC Add user r00t 219 bytes

Exploit for os-x/ppc platform in category shellcode ================================ os-x/PPC Add user r00t 219 bytes ================================ / PPC OS X / Darwin Shellcode by B-r00t. 2003. open; write; close; execve; exit; See ASM below. 219 Bytes! / char shellcode =...