1685 matches found
ACLight
ACLight A tool for advanced discovery of Privileged Accounts - including Shadow Admins. ACLight2 is the improved version of the tool. Shadow Admins Research The tool version 1 was published as part of the "Shadow Admins" research - more details on "Shadow Admins" are in the blog post:...
SkyArk
SkyArk is a cloud security project with two main scanning modules: 1. AzureStealth - Scans Azure environments 2. AWStealth - Scan AWS environments These two scanning modules will discover the most privileged entities in the target AWS and Azure. The Main Goal - Discover The Most Privileged Cloud...
the-bastion
🔒 The Bastion Overview Bastions are a cluster of machines used as the unique entry point by operational teams such as sysadmins, developers, database admins, ... to securely connect to devices servers, virtual machines, cloud instances, network equipment, ..., usually using ssh. The Bastion...
Download Monitor < 4.4.5 - SQL Injection
The Download Monitor plugin for WordPress is vulnerable to SQL injection via the 'orderby' parameter in versions before 4.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attacker...
CVE-2026-124436
OpenRemote versions prior to 1.32.2 are vulnerable to an improper authorization flaw (CWE-863). The issue stems from admin endpoints lacking sufficient super administrator checks, allowing realm administrators to access and modify global resources . Specifically, an attacker can manipulate the gl...
CVE-2026-124436 OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resources
OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other...
CVE-2026-124436 OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resources
OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other...
CVE-2026-124436 OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resources
OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other...
CVE-2026-123507
The project management software Vikunja (versions 0.24.0 before 2.7.1) is vulnerable to a nil pointer dereference (CWE-476) in its bucket filter handling. Project admins can trigger a Denial of Service (DoS) by saving a filter-mode bucket configuration containing a null filter. Because the valida...
CVE-2026-123507 Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter
Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in...
EUVD-2026-119392
Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in...
CVE-2026-123507 Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter
Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in...
CVE-2026-122302
Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeti...
EUVD-2026-117213
Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeti...
CVE-2026-118171
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions...
EUVD-2026-111348
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions...
CVE-2026-118171
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions...
CVE-2026-118171
The @strapi/content-manager package (versions >=0.0.0-experimental.0008b7f1c9e3678ad260dac74a24f2d9f8d8a5c7 to
CVE-2026-118171 CVE-2026-118171
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions...
CVE-2026-118171 CVE-2026-118171
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions...