CVE-2026-79652

A flaw in the JWT Bearer authorization grant within the keycloak-services component of Red Hat Build of Keycloak fails to verify whether a client requires user consent before issuing an access token. An authenticated attacker with valid client credentials and a trusted identity provider assertion...

cve-2026-34472-auth-bypass-zte-h188a-router

CVE-2026-34472 Technische Analyse von CVE-2026-34472, einem Auth-Bypass durch durchgesickerte Anmeldedaten, die die Firmware ZTE ZXHN H188A V6 betreffen. Zusammenfassung In den getesteten H188A V6-Builds können nicht authentifizierte Anfragen an den Stammpfad auf Pre-Login-Wizard-Handler zugreife...

CVE-2026-79652

A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...

Thank-u-Next

Thank u Next – CVE-2025-29927 Exploit Tool 🧠 Was ist CVE-2025-29927? Es ist nicht nur ein Bypass – es ist eine Offenbarung. Ein einzelner Header, der von der Middleware-Logik missverstanden und falsch behandelt wird, wird zu einem Hauptschlüssel für das, was verschlossen sein sollte. CVE-2025-299...

CVE-2024-55211

CVE-2024-55211 Vulnerabilità di autenticazione basata su cookie in Tk-Rt-Wr135G Fornitore interessato : Think Technology Prodotto interessato : Wireless Router Ac 1199Mbps Tk-Rt-Wr135G Versione interessata : Firmware V3.0.2-X000 Descrizione La vulnerabilità consente di bypassare il modulo di logi...

CVE-2022-1329

WP Elementor 3.6.0/1/2 रिमोट कोड निष्पादन root@kitploit: Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the version...

CVE-2021-21551

CVE-2021-21551 Einfacher PoC zur Ausnutzung von CVE-2021-21551 für LPE durch Starten von system cmd. https://vulners.com/cve/CVE-2021-21551 Es wurde ein Problem im signierten Dell-Windows-Treiber dbutil23.sys entdeckt, das zur Kompromittierung des gesamten lokalen Systems führen kann. Die...

hunt-for-cve-2018-10933

البحث عن واستغلال تجاوز المصادقة في libSSH CVE-2018-10933 دليل عملي يشرح كيفية إيجاد المضيفين المعرضين لتجاوز المصادقة في libSSH CVE-2018-10933 وكيفية استغلالهم للحصول على وصول شل. يرجى الرجوع إلى المقالة التالية للحصول على التعليمات: https://www.marcolancini.it/2018/blog-libssh-auth-bypass/...

CVE-2021-31630

CVE-2021-31630 OpenPLC 3 WebServer Esecuzione Remota di Codice Autenticata. Descrizione La presenza di Command Injection nel webserver Open PLC v3 consente a remoti attaccanti di eseguire codice arbitrario. Testato solo sulla macchina HTB Wifinetictwo.htb. Ho riscontrato problemi con tutti gli...

wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application Questa è un'applicazione vulnerabile per testare l'exploit del bypass di autenticazione di Really Simple Security 9.1.2 CVE-2024-10924. ATTENZIONE! Questa applicazione contiene gravi vulnerabilità di sicurezza. Eseguila a tuo...

wordpress-jetpack-broken-access-control-vulnerable-application

wordpress-jetpack-broken-access-control-vulnerable-application Questa è un'applicazione vulnerabile per testare l'exploit per il controllo di accesso non corretto broken access control di Jetpack 13.9.1 CVE-2024-9926. ATTENZIONE! Questa applicazione contiene serie vulnerabilità di sicurezza...

CVE-2024-23747

CVE-2024-23747 Il sistema di gestione ospedaliera ModernaNet 2024 di Moderna Sistemas è suscettibile a una vulnerabilità di Insecure Direct Object Reference IDOR. PoC Questa vulnerabilità risiede nella gestione dell'accesso ai dati utente da parte del sistema tramite un URL...

CVE-2026-76128

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-78570

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to elevate their privileges to that of an adminsitrator...

CVE-2026-49050

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...

CVE-2026-49845 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata including statistics updates, truncation targets, and...

EUVD-2026-65394

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update Schwachstelle für unbefugten Zugriff Broken Access Control Der /config/update-Endpunkt von LiteLLM prüft die Rollenberechtigungen des Aufrufers nicht. Jeder authentifizierte Benutzer mit einem gültigen API-Key ohne Administratorrechte kann die...

CorruptQueryAccessWorkaround

CorruptQueryAccessWorkaround: la query '' è danneggiata La soluzione alternativa più recente per l'errore Query is corrupt introdotto con CVE-2019-1402 in MS Access. Esistono altre soluzioni alternative che devono essere applicate a livello amministrativo, ad esempio disinstallando l'aggiornament...

EUVD-2026-65391

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...