82980 matches found
CVE-2025-7775-vulnerable-lab
Laboratorio Vulnerable CVE-2025-7775 Este repositorio proporciona una configuración vulnerable para probar la plantilla de nuclei para CVE-2025-7775. Ejecución docker build -t vuln-app . docker run -d --name vuln-test -p 5000:5000 vuln-app Pruebas de Vulnerabilidad 1. Ejecución Remota de Comandos...
CVE-2026-107180
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
CVE-2026-105138
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...
CVE-2026-23744
CVE-2026-23744 — MCPJam Inspector Unauthenticated RCE Unauthenticated remote code execution PoC for CVE-2026-23744. MCPJam Inspector 1.4.2 and earlier expose functionality through /api/mcp/connect that can launch an attacker-controlled MCP server command without authentication. For authorized...
CVE-2026-54519
CVE-2026-54519 ai-agent-automation la falta de comprobaciones de propiedad en las API de memoria permitía la lectura y eliminación de memoria entre usuarios. Aviso principal: GHSA-qv97-83w4-ff86 Crédito del investigador: @chaitanyagarware De un vistazo Campo| Valor ---|--- CVE| CVE-2026-54519 GHS...
CVE-2025-54123
CVE-2025-54123 Inyección de Comandos en Hoverfly a RCE PoC Resumen Este repositorio contiene un script de prueba de concepto PoC en Python para interactuar con instancias de Hoverfly afectadas por CVE-2025-54123. El script soporta: Autenticación usando credenciales de nombre de usuario/contraseña...
CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
CVE-2026-107180
On MISP instances where Security.otp_required is enabled, a logic flaw allows authenticated users to bypass mandatory TOTP enrolment . The enforcement mechanism only applied to standard browser requests; consequently, users could bypass the setup by issuing non-browser requests such as AJAX/XHR c...
EUVD-2026-94318
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...
CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...
EUVD-2026-94309
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...
CVE-2026-105138
The Obot platform versions 0.12.0 before 0.26.2 is vulnerable to a credential exposure flaw in the MCP Catalog Entry API . Due to insufficiently protected credentials, authenticated basic users with access to an entry can perform a GET request to /api/all-mcps/entries/{entry_id}. This action allo...
CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...
CVE-2026-104073
A flaw was found in NetBox. An authenticated user with permission to create custom links can exploit a template injection vulnerability to access sensitive session information and Application Programming Interface API tokens. When a victim views an object containing the malicious link, their...
CVE-2026-85706
CVE-2026-85706 GitLab unauthenticated arbitrary file read ★ CVE-2026-85706 GitLab unauthenticated arbitrary file read PoC ★ https://github.com/user-attachments/assets/026749ec-04e9-4dd5-9453-cb7c1f6e823d Overview CVE-2026-85706 is an unauthenticated arbitrary file read in GitLab CE/EE CVSS 10.0,...
SessionReaper-CVE-2025-54236
SessionReaper — CVE-2025-54236 Unified PoC for CVE-2025-54236 "SessionReaper", a critical unauthenticated RCE in Magento 2 / Adobe Commerce via nested deserialization in the REST API. CVSS: 9.1 Critical Root cause: Improper Input Validation CWE-20 in ServiceInputProcessor; the exploit primitive i...
CVE-2024-39722
Ollama CVE-2024-39722 Exploit Tool This tool is designed to exploit CVE-2024-39722, a model existence disclosure vulnerability in Ollama versions up to and including 0.1.45. It allows users to check if an Ollama server is vulnerable and attempt to discover existing models on the server...