Cobbler - Authentication Bypass

Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API /cobblerapi that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting...

Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution

Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to...

Web-Check < 2.0.1 Screenshot API - OS Command Injection

Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters. id: CVE-2025-32778 info: name: Web-Check 2.0.1 Screenshot API - OS Command Injection author:...

PraisonAI - Authentication Bypass

PraisonAI 2.5.6 to 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server. id: CVE-2026-44338 info: name: PraisonAI -...

SolarWinds Orion API - Auth Bypass

SolarWinds Orion API is vulnerable to an authentication bypass vulnerability that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance...

CVE-2020-12432

CVE-2020-12432 Collabora CODE...

EUVD-2026-94660

Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of confidentiality, integrity, and availability. All software...

CVE-2026-87726

Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of confidentiality, integrity, and availability. All software...

PyHook

PyHook PyHook es la implementación en Python de mi proyecto SharpHook. Utiliza varios hooks de API para obtener las credenciales deseadas. PyHook usa Frida para inyectar sus dependencias en el proceso objetivo. Procesos compatibles Proceso| Llamada API| Descripción| Progreso ---|---|---|--- mstsc...

CVE-2021-45232-RCE

CVE-2021-45232 CVE-2021-45232 Apache apisix Dashboard API RCE sin autenticación Versión: 2.10.1 Fofa: title="Apache APISIX Dashboard" POC: IP:PORT/apisix/admin/migrate/export...

CVE-2022-1442

CVE-2022-1442 WordPress Plugin Metform = 2.1.3 - Control de Acceso Inadecuado que Permite la Divulgación No Autenticada de Información Sensible Descripción Es vulnerable a la divulgación de información sensible debido a un control de acceso inadecuado en el archivo /core/forms/action.php, que pue...

CVE-2026-87679

When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploi...

CVE-2026-87680

A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters...

EUVD-2026-94657

Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads such as device configuration attributes or port mapping requests the REST API service fails to properly validate...

CVE-2026-87683

Brocade Fabric OS versions prior to 10.0.1 are susceptible to multiple stack-based buffer overflow vulnerabilities within the REST API management component . The root cause is a failure to properly validate incoming array counts and string lengths against internal buffer capacities when processin...

CVE-2026-87683

Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads such as device configuration attributes or port mapping requests the REST API service fails to properly validate...

Exploit for CVE-2026-107268

CVE-2026-107268: miniOrange 2FA for Drupal returns the site's...

CLEANSTART-2026-PZ72315 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

EUVD-2026-94654

A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters...

CVE-2026-87680

A command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions prior to 10.0.1 . This flaw allows an authenticated user to execute arbitrary system commands by providing crafted input parameters . The vulnerability is addressed in FOS 10.0.1 .