BIT-GRAFANA-2026-81842 Library panel can be moved into a folder without library panel create permission

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...

CVE-2026-33017-Langflow-RCE

CVE-2026-33017 - Vulnerabilità RCE di Langflow xpl0ited da infrar3d Questo proof-of-concept sfrutta una vulnerabilità critica di Remote Code Execution RCE nelle versioni di Langflow precedenti alla 1.9.0. La vulnerabilità consente a utenti non autenticati di eseguire comandi di sistema arbitrari...

Detect-CVE-2024-0762

CVE-2024-0762 Script di Rilevamento e Analisi Malware Panoramica Questo script è progettato per rilevare le versioni del firmware UEFI e valutarle per vulnerabilità correlate a CVE-2024-0762. Inoltre, si integra con l'API VirusTotal per analizzare i file alla ricerca di malware, fornendo...

EntraTrace

EntraTrace EntraTrace is a defensive security research tool for documenting and identifying the observable behavior of offensive tooling targeting Microsoft Entra ID. The project builds a automatic knowledge base around tools such as AzureHound, AADInternals, O365Enum, PingCastle , and others, wi...

IBM-Langflow-CVE-2026-48519-poc

IBM Langflow RCE pre-auth nei Playground condivisibili . In esecuzione su versione/i -c ""...

Zena-CVE-2021-45026

Zena - Stored XSS zu RCE Exploit POC Exploit POC für die Zena-Anwendung von Rocket Software v. 4.2.1 - Stored XSS to RCE CVE-2021-45025 CVE-2021-45026 https://phoenix-sec.io/2022/06/17/Zena-CookieMonsteRCE.html POC-Prozess: Meldet sich mit Standard-Anmeldedaten auf der Webconfig-Seite von Zena an...

CVE-2025-54914-PoC

CVE-2025-54914 Azure Route Exploit Overview This is an improved implementation of the CVE-2025-54914 Azure Networking Route exploit. This version maintains the core CVE functionality while adding more features including persistence, evasion, multi-target scanning, and error handling. Features Cor...

Arbitrary Code Execution

Apache Syncope is vulnerable to an Arbitrary Code Execution. The vulnerability is due to imported BPMN processes allowing unsandboxed Groovy scriptTask execution, which allows an attacker with sufficient administrative entitlements to import and start a malicious BPMN process through the REST API...

CVE-2026-48017

CVE-2026-48017 — Remote Code Execution in DbGate via functionName injection Severity : High CVSS 8.8 CWE : CWE-94 — Improper Control of Generation of Code 'Code Injection' Affected : dbgate-api ≤ 7.1.8 patched in 7.1.9 Advisory : GHSA-hv83-ggc4-v385 NVD :...

CVE-2025-7775-PoC

CVE-2025-7775 | NetScaler ADC RCE PoC ⚠️ Disclaimer: questo è un PoC ipotetico solo per scopi didattici. Segmentare le reti NetScaler. CVE-2025-7775 non esiste. Utilizzare solo in un laboratorio isolato. Panoramica Exploit simulato per una RCE non autenticata e ipotetica in Citrix NetScaler...

CVE-2026-39794

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2025-11203-PoC

CVE-2025-11203 — LiteLLM Health Endpoint APIKEY Information Disclosure LiteLLM versioni 1.63.14 non filtra correttamente le informazioni sensibili nell'endpoint /health durante l'elaborazione del parametro apikey, consentendo agli utenti autenticati di ottenere le chiavi API memorizzate in altre...

AndroidSecurityEvolution

Evoluzione della Sicurezza di Android Miglioramenti significativi della sicurezza delle principali versioni recenti di Android, a partire da Android 5.0 Lollipop API 21. Android 5.0 API 21 - Lollipop Security Enhancements - Android 5 A partire da agosto 2023, gli aggiornamenti di Google Play...

CVE-2026-39794 WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2026-39794 WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

EUVD-2026-93038

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2026-39794

The WooCommerce Multivendor Marketplace – REST API plugin for WordPress (versions

CVE-2026-105305

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

CVE-2026-105305 Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

EUVD-2026-93019

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...