nextjs-middleware-bypass-demo

CVE-2025-29927 Demo Original writeup: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware Setup First, run the development server: root@kitploit: npm i npm run dev Open http://localhost:3000 with your browser to see the result. Trying out the bypass curl -I...

nomore403

NoMore403 nomore403 هي أداة سطر أوامر لاختبار تجاوز التحكم في الوصول عبر HTTP والتناقضات في تحليل الطلبات حول الاستجابات 401 و 403 وما يتصل بها. صُممت الأداة للعمل العملي في مجال أمن الويب: مكافآت الثغرات، اختبار الاختراق، مراجعات الأمان، واختبار الانحدار لقواعد التحكم في الوصول. تقوم بأتمتة مجمو...

CVE-2026-93594

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

EUVD-2026-82890

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the querydatabase tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowi...

EUVD-2026-82889

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

CVE-2026-93594

ArcadeDB (Maven com.arcadedb:arcadedb-engine) through 26.8.1 enforces per-type/per-record access-control rules only in LocalBucket, keyed on file ID. Query paths reaching data through LSM index files or the TimeSeries engine skip that permission check entirely. An authenticated user denied readRe...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Aperçu des vulnérabilités CVE-2025-30208, CVE-2025-31125 et CVE-2025-31486 sont des vulnérabilités de lecture de fichiers arbitraires dans le serveur de développement de Vite. Ces vulnérabilités permettent à un attaquant de contourner le contrôl...

CVE-2026-67182-HTTP-Request-Smuggling-Enables-Front-End-Access-Control-Bypass-rouille-

Security Advisory: HTTP Request Smuggling Enables Front-End Access Control Bypass rouille Assigned CVE ID: CVE-2026-67182 Summary rouille::proxy::proxy and rouille::proxy::fullproxy copy client-supplied request header values into the upstream connection without checking them for control character...

The vulnerability of the dns.Msg.Unpack() function in the plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go files of the coredns server allows a attacker to compromise the integrity of the protected information.

The vulnerability of the dns.Msg.Unpack function in the plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go files of the coredns server is related to the ability to bypass access control mechanisms. Exploiting this vulnerability allows a malicious actor to...

Linux Distros Unpatched Vulnerability : CVE-2026-90153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two AC...

EUVD-2026-81746

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...

CVE-2026-90153 ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...

CVE-2026-90153

CVE-2026-90153 affects the Linux kernel ksmbd subsystem (in-kernel SMB server). The vulnerable function smb_check_perm_dacl() bounds its ACE walks by the remaining NT security descriptor length (acl_size) instead of the DACL's declared size (pdacl_size). An attacker with low privileges can craft ...

CVE-2021-40346

CVE-2021-40346 Integer overflow on header request internal representation allows HTTP request smuggling. This repository presents a PoC built with docker-compose using two docker images: one with a vulnerable version of HaProxy in this case 2.2.16 and one with a Flask web server using Gunicorn as...

SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / etc (SUSE-SU-2026:4203-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4203-1 advisory. - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: Apache Tomcat: TOCTOU when...

CVE-2026-25890-FileBrowser-Access-Control-Bypass

CVE-2026-25890 - Contournement du contrôle d'accès FileBrowser Les utilisateurs non authentifiés ne peuvent pas exploiter cette faille — nécessite des identifiants valides à faibles privilèges restreints pour le chemin cible. Contournement de l'autorisation basée sur le chemin dans FileBrowser ≤...

CVE-2026-20121

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

CVE-2026-20120

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

EUVD-2026-81050

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write...

EUVD-2026-81040

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access...