86494 matches found
GEO.RITM REST API Auth Bypass Info Disclosure
The vulnerability of the software interface REST API of the GEO.RITM software lies in the lack of authentication when accessing the function for retrieving object attributes. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to confidential information...
CVE-2026-77936 Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access
Letta through 0.16.8 ships a compose.yaml that does not enable LETTASERVERSECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST...
CVE-2026-77936
Versions of Letta through 0.16.8 are vulnerable to an insecure default configuration due to a compose.yaml file that fails to enable LETTA_SERVER_SECURE . This omission prevents the password middleware from being added, leaving all API routes unauthenticated . Additionally, the configuration expo...
CVE-2026-77932 DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock getuserfromheaders function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandbox...
CVE-2026-77932
DB-GPT versions through 0.8.2 are vulnerable to an unauthenticated remote code execution (RCE) vulnerability. The flaw exists because the /api/v1/chat/react-agent endpoint utilizes a mock get_user_from_headers function that incorrectly assigns every caller the admin role . Attackers can exploit t...
EUVD-2026-104663
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclose...
EUVD-2026-104664
A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could...
EUVD-2026-104633
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...
EUVD-2026-104644
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated...
EUVD-2026-104643
TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...
Microsoft Windows Cloud Files Mini Filter Driver CldiStreamPrepareRequestForMoreProcessing Type Confusion vulnerability
Summary A type confusion vulnerability exists in the CldiStreamPrepareRequestForMoreProcessing functionality of Windows Cloud Files Mini Filter Driver versions: 10.0.26100.8457 WinBuild.160101.0800 and 10.0.26100.8655 WinBuild.160101.0800. A specially crafted sequence of Cloud Filter API calls ca...
cve-2018-15133
POC - CVE-2018-15133 Usage: $ ./CVE-2018-15133 -h Usage: ./CVE-2018-15133 options Options: -APIKEY string API key del sitio web de Laravel, codificada en base64 -URL string URL del sitio web de Laravel a atacar -command string Comando a ejecutar en el sitio web vulnerable; si no se especifica, se...
CVE-2022-3172
CVE-2022-3172 demo Run poc.sh create resources chmod +x poc.sh ./poc.sh Use Curl curl https://kubernetes.default.svc/apis/metrics.k8s.io/v2beta1/ -k -H "Authorization: Bearer token"...
peframe
======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...
EDRs
EDRs This repo contains information about EDRs that can be useful during red team exercise. patchsyscalldynamically64.c This proof-of-concept is resolving the syscall ID dynamically no need to check the version running on the remote host. To get the information on disk not tampered a call to...
CVE-2026-112372
A path traversal vulnerability exists in H3C Magic NX15 V100R017 . The issue is located in the importprofile function of the /api/upload file, where a lack of proper input validation on the fileName argument allows for path traversal. This weakness can be exploited remotely to access or manipulat...
VulnerableSpringDataRest
Vulnerable Spring DataRest App This is an intentionally Spring Data REST Application to test and demostrate the CVE-2017-8046 vulnerability and the challenges of testing Command Injection and Remote Code Execution via REST apis It has support for Swagger UI to use with tools where Swagger...
UhOh365
UhOh365 A script that can see if an email address is valid in Office365. This does not perform any login attempts, is unthrottled, and is incredibly useful for social engineering assessments to find which emails exist and which don't. Microsoft does not consider "email enumeration" a vulnerabilit...
uncover
Quickly discover exposed hosts on the internet using multiple search engines. Features • Installation • Usage • Configuration • Running Uncover • Join Discord uncover is a go wrapper using APIs of well known search engines to quickly discover exposed hosts on the internet. It is built with...