CVE-2026-76292 Missing Authorization through REST API Endpoints in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "scadmin" Splunk Secure Gateway role could read mobile alert notification data for...

CVE-2026-76290 Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potential...

CVE-2026-76290

Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11 are vulnerable to a Denial of Service (DoS) attack. An unauthenticated user can send repeated requests to the Edge Processor package download endpoint within the Splunk Pipeline Builders app . The root cause is that the endpoint allows ...

CVE-2026-76289 Denial of Service (DoS) through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer REST API endpoint for lookup table...

CVE-2026-76289

Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 are vulnerable to a Denial of Service (DoS) attack. A user without "admin" or "power" roles can make the instance unavailable by sending a request to the REST API endpoint for lookup table files. The root cause is that the endpo...

CVE-2026-76287 Authorization Bypass in the Data Management REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, a user that holds a role with the previewdatamanagementpipeline capability or editdatamanagementpipelinejob capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope. The vulnerability is possible becaus...

CVE-2026-76287

Splunk Enterprise versions prior to 10.4.4 are vulnerable to an authorization bypass in the Data Management REST API . A user with the preview_data_management_pipeline or edit_data_management_pipeline_job capability can read or delete Data Management SPL2 preview jobs and results outside their ow...

CVE-2025-59057-PoC

A XSS vulnerability exists in in React Router's meta/ APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag...

CVE-2025-56643

CVE-2025-56643 Public reference for CVE-2025-56643 – Wiki.js 2.5.307 JWT Session Vulnerability Description: Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the...

CVE-2025-59843-CVE-2025-59932

CVE-2025-59843 & CVE-2025-59932 1. Public Exposure of User Email Addresses CVE-2025-59843 In Scope / Affected Application: FlagForge Web Application API Endpoint: /api/user/username Details: The endpoint returns user email addresses without authentication. Any username can be queried publicly...

CVE-2025-4796

CVE-2025-4796 Eventin Once the email is changed to an attacker-controlled address, the standard WordPress password reset flow can be used to take over the account. 🧰 Script PoC Filename: CVE-2025-4796.py This script automates the steps: 1. Log in to the target WordPress site using supplied...

CVE-2026-48907

CVE-2026-48907 Description This file CVE-2025-9209.py is a mass exploitation tool targeting vulnerability CVE-2025-9209. Core functionalities: Scans a list of sites by calling /wp-json/wp/v2/users Analyzes the response to look for sensitive user data such as public and private keys, tokens, and...

CVE-2025-8110

Gogs Arbitrary File Write to RCE CVE-2025-8110 - Educational Use Exploit This repository contains a Proof of Concept PoC script in Python to demonstrate and analyze the vulnerability registered as CVE-2025-8110 in the self-hosted Git service Gogs versions 0.13.3 and earlier. ⚠️ Disclaimer !WARNING...

WP2Shell-CVE-2026-63030-POC

WP2Shell Detector and Validation PoC CVE coverage: CVE-2026-63030 and CVE-2026-60137 Intended use: Authorized security testing, defensive validation, and disposable localhost labs only WP2Shell is a WordPress Core vulnerability chain combining a pre-authentication REST API batch-route confusion b...

the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM 1.8.2 REST API Authentication Bypass Unauthenticated authentication bypass in the phpIPAM REST API, caused by an object-cache key collision: the database row cached while resolving an API app's appid satisfies the subsequent appcode token check whenever the supplied token...

CVE-2026-8054

1. Vulnerability Overview CVE-2026-8054 is a high-severity pre-authentication SQL injection vulnerability Pre-auth SQL Injection in the dotCMS Core Publish Audit API. The vulnerability is officially tracked as Security Incident SI-75 and was formally disclosed at the end of May 2026. Since...

CVE-2026-114379

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...

CVE-langgraph

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone cd Project use python follow below Create a virtual environment python -m venv...

Arisu

Arisu — AI Key Automated Mining System Arisu is a tool that automatically scans public code repositories GitHub, GitLab, Gitee, Docker Hub, PyPI, npm, etc. and code snippets Gist, Issues, CommonCrawl, extracts AI service API keys DeepSeek, OpenAI, Anthropic, Kimi, etc., and verifies their validit...

CVE-2026-41179

CVE-2026-47668 Test environment for rclone RCE REF1: https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q REF2: https://github.com/pssec-io/CVE-2026-41179 rce.py RCE on /operations/fdinfo, redirects output to stderr for convenience ./rce.py uname -a exit status 1 Return code: ...