CVE-2026-76726

An authentication bypass vulnerability exists in the API endpoint of HPE Networking Instant ON . An unauthenticated remote attacker could bypass network access controls, provided certain preconditions outside of the attacker's control are met. Successful exploitation may result in unauthorized ac...

CVE-2026-76726 Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint

An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain...

CVE-2026-44277

🚨 CVE-2026-44277 - FortiAuthenticator 認証不要RCE Fortinet FortiAuthenticatorにおける重大な認証不要のリモートコード実行 📋 概要 CVE-2026-44277 は、Fortinet FortiAuthenticator における重大な脆弱性であり、特定のAPIエンドポイントでの不適切なアクセス制御により、認証不要の攻撃者 がリモートコード実行（RCE）を達成できるものです。 🛠 影響を受けるバージョン 製品| 脆弱なバージョン| 修正バージョン ---|---|--- FortiAuthenticator| 6.5.0...

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io：/api/v1/full-spec 缺少身份验证，泄露完整 OpenAPI 架构 产品： dgtlmoon/changedetection.io — v0.55.7 文件： changedetectionio/api/Spec.py CWE： CWE-306 — 关键功能缺少身份验证 CVSS 3.1： AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — 5.3（中危） CNA： Turan Security · CVE 记录 描述 changedetection.io 的 REST API...

gitlab_rce_cve-2022-2884

gitlabrcecve-2022-2884 これは、CVE-2022-2884 として知られる GitLab の認証済み RCE 脆弱性を悪用する Python3 プログラムです。 免責事項 このツールは、セキュリティエンジニアおよびアプリケーションセキュリティ（AppSec）担当者がセキュリティ評価を行うことを目的としています。このツールは責任を持って使用してください。本アプリケーションの使用方法については一切責任を負いません。このツールを使用して引き起こされた損害や犯された犯罪についても、一切責任を負いません。 脆弱性情報 CVE-ID : CVE-2022-2884 リンク :...

SmartAsset-CORS-CVE-2020-26527

SmartAsset-CORS-CVE-2020-26527 CVE-2020-26527 Smart Asset - バージョン 2020.7 Damstra Smart Asset 2020.7 の API/api/Version で問題が発見されました。 クロスオリジンリソースシェアリングは、任意の 'Origin: example.com' ヘッダーを受け入れ、200 OK とワイルドカードの 'Access-Control-Allow-Origin: ' ヘッダーで応答することにより、ランダムなオリジンを信頼します。 HTTP リクエスト: GET /API/api/Versi...

PT-2026-102870

🚨 CVE-2026-76726 An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an...

PT-2026-102882

Name of the Vulnerable Software and Affected Versions HPE Networking Instant On affected versions not specified Description A buffer overflow occurs in the API endpoint, which may allow an authenticated attacker with administrative privileges to trigger a denial of service. This condition can...

PT-2026-102873

🚨 CVE-2026-76729 A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service...

CVE-2026-57821-PoC-Exploit

🛡️ CVE-2026-57821 – Apache Fineract SQL 注入 ⚠️ 法律与道德声明 本工具包仅供教育、培训和经授权的安全测试使用 。 未经明确书面许可而对任何系统进行未经授权的使用均属违法 ，并违反计算机犯罪相关法律。 作者对滥用或造成的损害不承担任何责任 。 您须对自己的行为负全部责任。 📋 漏洞概述 CVE-2026-57821 是 Apache Fineract 的办公室列表 API 端点中发现的一个 SQL 注入 漏洞。 🎯 受影响组件 属性| 详情 ---|--- 端点| /api/v1/offices 参数| orderBy 方法| GET 是否需要认证|...

CVE-2026-100885

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...

CVE-2026-100885 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...

CVE-2026-100885 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...

CVE-2026-23744

CVE-2026-23744 — MCP Connect RCE via Unauthenticated Command Injection ⚠️ Disclaimer: This repository is for educational and security research purposes only. Using this exploit against systems without explicit authorization is illegal. The author is not responsible for any misuse of this code. 📌...

CVE-2026-96803 java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection

A vulnerability was identified in java110 MicroCommunity up to 2.0. Affected is the function QueryServiceSMOImpl.fallBack of the file BusinessApi.java of the component fallBack API Endpoint. Such manipulation of the argument fallBackSql leads to sql injection. The attack may be launched remotely...

CVE-2026-96803 java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection

A vulnerability was identified in java110 MicroCommunity up to 2.0. Affected is the function QueryServiceSMOImpl.fallBack of the file BusinessApi.java of the component fallBack API Endpoint. Such manipulation of the argument fallBackSql leads to sql injection. The attack may be launched remotely...

PT-2026-97684

Name of the Vulnerable Software and Affected Versions java110 MicroCommunity versions prior to 2.1 Description Remote manipulation of the fallBackSql argument within the QueryServiceSMOImpl.fallBack function of the BusinessApi.java file in the fallBack API endpoint allows for SQL injection. SQL...

CVE-2026-95929

A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sq...

Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

Impact A vulnerability was found in Graylog's API endpoint for updating saved searches and dashboards. A user with edit permissions on a dashboard or saved search could grant owner permissions to an arbitrary account, which could then be used to delete the respective saved search or dashboard or ...

GHSA-M9C2-85GV-8XR5 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

Impact A vulnerability was found in Graylog's API endpoint for updating saved searches and dashboards. A user with edit permissions on a dashboard or saved search could grant owner permissions to an arbitrary account, which could then be used to delete the respective saved search or dashboard or ...