CVE-2026-20896

Código de la Prueba de Concepto CVE-2026-20896 Este script automatiza la explotación del fallo de lógica en la validación de rutas de la API de Gitea, permitiendo forzar al servidor a otorgar un token administrativo válido mediante un ataque de salto de directorio Directory Traversal en la cabece...

CVE-2024-42327

CVE-2024-42327: Escalada de Privilegios en Zabbix - RCE Descripción Este Proof-of-Concept PoC se puede utilizar para explotar CVE-2024-42327, filtrar el token de autenticación de la API de administración y crear un elemento para obtener una reverse shell en un servidor Zabbix 6.0.32rc1, 6.4.17rc1...

Dgraph <= 25.3.2 - Admin Token Disclosure

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...

CVE-2026-82329-JFrog-Artifactory-Auth-Bypass

artifactory.py ╔══════════════════════════════════════════════════════════╗ ║ artifactory · CVE-2026-82329 unauth admin takeover ║ ║ mitsec · https://x.com/ynsmroztas ║ ╚══════════════════════════════════════════════════════════╝ CVE-2026-82329 — JFrog Artifactory self-hosted unauthenticated...

CVE-2024-27198_Lab

CVE-2024-27198Lab Vulnerability Research & Purple Team Demonstration Lab for JetBrains TeamCity Authentication Bypass CVE-2024-27198 Table of Contents About The Project CVE Details Built With Threat Intelligence & OSINT Real-World Impact & Exploitation Why this CVE is Critical Getting Started...

Exploit for Improper Authentication in Jfrog Artifactory

CVE‑2026‑82329 – JFrog Artifactory Auth B...

CVE-2026-86754 Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

CVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

CVE-2026-80172

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions contain an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated remote attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens , since there is no nonce valida...

CVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

EUVD-2026-74853

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

Exploit for Improper Authentication in Jfrog Artifactory

CVE-2026-82329-JFrog-Artifactory- CVE-2026-82329 — JFrog Arti...

SUSE CVE-2026-40173

Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, exposing the full process command line...

Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure

Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-82329 CVSS score: 9.8, a case of authentication bypass that could lead to administrative access in...

Exploit for CVE-2026-82329

CVE-2026-82329 — JFrog Artifactory unauthenticated auth bypass...

CVE-2026-82882

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2026-79667 Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

EUVD-2026-65447

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

Cross-site Scripting (XSS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the addJs and addCss methods in the Twig sandbox allowlist. An attacker can execute arbitrary scripts in the...

CVE-2026-48162

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...