Lucene search
+L

2711 matches found

Kitploit
Kitploit
added 2026/09/18 10:13 p.m.11 views

nextjs-middleware-bypass-demo

CVE-2025-29927 Demo Original writeup: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware Setup First, run the development server: root@kitploit: npm i npm run dev Open http://localhost:3000 with your browser to see the result. Trying out the bypass curl -I...

9.1CVSS7.7AI score0.99225EPSS
SaveExploits59References1
Kitploit
Kitploit
added 2026/09/18 10:09 p.m.15 views

nomore403

NoMore403 nomore403 هي أداة سطر أوامر لاختبار تجاوز التحكم في الوصول عبر HTTP والتناقضات في تحليل الطلبات حول الاستجابات 401 و 403 وما يتصل بها. صُممت الأداة للعمل العملي في مجال أمن الويب: مكافآت الثغرات، اختبار الاختراق، مراجعات الأمان، واختبار الانحدار لقواعد التحكم في الوصول. تقوم بأتمتة مجمو...

5.8AI score
SaveExploits0References4
NVD
NVD
added 2026/09/18 2:19 p.m.5 views

CVE-2026-93594

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

8.1CVSS0.00337EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/18 1:20 p.m.4 views

EUVD-2026-82890

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the querydatabase tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowi...

7.1CVSS0.00286EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/18 1:20 p.m.6 views

EUVD-2026-82889

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

8.1CVSS0.00337EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/18 1:20 p.m.10 views

CVE-2026-93594

ArcadeDB (Maven com.arcadedb:arcadedb-engine) through 26.8.1 enforces per-type/per-record access-control rules only in LocalBucket, keyed on file ID. Query paths reaching data through LSM index files or the TimeSeries engine skip that permission check entirely. An authenticated user denied readRe...

8.1CVSS0.00337EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/18 8:04 a.m.9 views

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Aperçu des vulnérabilités CVE-2025-30208, CVE-2025-31125 et CVE-2025-31486 sont des vulnérabilités de lecture de fichiers arbitraires dans le serveur de développement de Vite. Ces vulnérabilités permettent à un attaquant de contourner le contrôl...

7.5CVSS6.8AI score0.74969EPSS
SaveExploits35
Kitploit
Kitploit
added 2026/09/18 7:48 a.m.11 views

CVE-2026-67182-HTTP-Request-Smuggling-Enables-Front-End-Access-Control-Bypass-rouille-

Security Advisory: HTTP Request Smuggling Enables Front-End Access Control Bypass rouille Assigned CVE ID: CVE-2026-67182 Summary rouille::proxy::proxy and rouille::proxy::fullproxy copy client-supplied request header values into the upstream connection without checking them for control character...

7.5CVSS5.9AI score0.00415EPSS
SaveExploits1References1
BDU FSTEC
BDU FSTEC
added 2026/09/18 12:00 a.m.7 views

The vulnerability of the dns.Msg.Unpack() function in the plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go files of the coredns server allows a attacker to compromise the integrity of the protected information.

The vulnerability of the dns.Msg.Unpack function in the plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go files of the coredns server is related to the ability to bypass access control mechanisms. Exploiting this vulnerability allows a malicious actor to...

7.8CVSS0.00436EPSS
SaveExploits0References4Affected Software1
Tenable Nessus
Tenable Nessus
added 2026/09/18 12:00 a.m.5 views

Linux Distros Unpatched Vulnerability : CVE-2026-90153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two AC...

8.1CVSS0.00445EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/09/17 4:06 p.m.6 views

EUVD-2026-81746

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...

0.00445EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/09/17 4:06 p.m.24 views

CVE-2026-90153 ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...

8.1CVSS0.00445EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/17 4:06 p.m.12 views

CVE-2026-90153

CVE-2026-90153 affects the Linux kernel ksmbd subsystem (in-kernel SMB server). The vulnerable function smb_check_perm_dacl() bounds its ACE walks by the remaining NT security descriptor length (acl_size) instead of the DACL's declared size (pdacl_size). An attacker with low privileges can craft ...

8.1CVSS0.00445EPSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/17 12:58 a.m.11 views

CVE-2021-40346

CVE-2021-40346 Integer overflow on header request internal representation allows HTTP request smuggling. This repository presents a PoC built with docker-compose using two docker images: one with a vulnerable version of HaProxy in this case 2.2.16 and one with a Flask web server using Gunicorn as...

7.5CVSS7.9AI score0.57934EPSS
SaveExploits6
Tenable Nessus
Tenable Nessus
added 2026/09/17 12:00 a.m.6 views

SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / etc (SUSE-SU-2026:4203-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4203-1 advisory. - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: Apache Tomcat: TOCTOU when...

9.8CVSS0.0083EPSS
SaveExploits0References34
Kitploit
Kitploit
added 2026/09/16 10:53 p.m.11 views

CVE-2026-25890-FileBrowser-Access-Control-Bypass

CVE-2026-25890 - Contournement du contrôle d'accès FileBrowser Les utilisateurs non authentifiés ne peuvent pas exploiter cette faille — nécessite des identifiants valides à faibles privilèges restreints pour le chemin cible. Contournement de l'autorisation basée sur le chemin dans FileBrowser ≤...

8.1CVSS8.3AI score0.00469EPSS
SaveExploits2
NVD
NVD
added 2026/09/16 9:17 p.m.9 views

CVE-2026-20121

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

5.3CVSS0.00487EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/16 9:17 p.m.11 views

CVE-2026-20120

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

5.8CVSS0.00406EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/16 8:32 p.m.9 views

EUVD-2026-81050

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write...

9.8CVSS0.00375EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/16 8:32 p.m.6 views

EUVD-2026-81040

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access...

8.6CVSS0.0025EPSS
SaveExploits0References4
Rows per page
Query Builder