CVE-2026-76454 Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This...

CVE-2026-76454

A vulnerability exists in the Cisco Smart Licensing Utility API of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem). Due to improper input validation and a lack of authentication in the management API, an unauthenticated remote attacker can send a crafted request to write arb...

CVE-2026-20321 Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...

EUVD-2026-94524

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...

CVE-2026-20321

A vulnerability exists in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) . Due to insufficient input validation of user-controlled command arguments, an authenticated remote attacker with valid administrative credentials can send crafted input to the AP...

CVE-2026-62253 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions JWTMiddleware and JWTMiddlewareV4 immediately return nextc when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under...

CVE-2026-62253 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions JWTMiddleware and JWTMiddlewareV4 immediately return nextc when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under...

CVE-2026-62253

The Homer telecom observability software is vulnerable to a complete authentication bypass in versions prior to 11.0.283 . The root cause is that both JWTMiddleware and JWTMiddlewareV4 functions (located in coordinator/handlers/auth.go and coordinator/handlers/auth_v4_helpers.go) are designed to ...

EUVD-2026-94522

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...

Exchange2domain

Exchange2domain Outil tout-en-un de privexchange. Vous avez seulement besoin d'ouvrir le port du serveur web, donc aucun privilège élevé n'est requis. Excellent article ! Abusing Exchange: One API call away from Domain Admin. Prérequis Ces outils nécessitent impacket. Vous pouvez l'installer avec...

EUVD-2026-94521

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

Cisco License (Smart Software Manager) On-Prem Vulnerabilities

Multiple vulnerabilities in the web-based management interface and API endpoints of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow a remote attacker to gain unauthorized access, access sensitive information, cause a denial of service DoS condition, o...

Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...

Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation of data that is...

CVE-2020-17518

Apache Flink directory traversal vulnerability, allows remote file read/write via REST API Vulnerability ID: CVE-2020-17518 Vulnerability Description: CVE-2020-17518: Write remote files via REST API Affected Versions: Flink 1.5.1-1.11.2 Safe Versions: Flink 1.11.3 or Flink 1.12.0 Flink 1.5.1...

o365-attack-toolkit

What is o365-attack-toolkit o365-attack-toolkit allows operators to perform oauth phishing attacks. We decided to move from the old model of static definitions to fully "interactive" with the account in real-time. Some of the changes Interactive E-mail Search - Allows you to search for user e-mai...

dnsFookup

DnsFookup v 2.0.1 Revinculación de DNS framework que contiene: un servidor DNS obviamente API web en Python para crear nuevos subdominios y controlar el servidor DNS, ver registros, cosas por el estilo una cutre aplicación React para hacerlo más cómodo Registro de cambios Documentación de la API...

CVE-2026-107273

Gophish versions 0.11.0 through 0.12.1 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability via the POST /api/import/site endpoint. This flaw allows authenticated low-privileged users to submit internal URLs that the default dialer deny list fails to block. Successful exploitation...

CVE-2026-107273 Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

CVE-2026-107273 Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...