OFFAT

OWASP OFFAT OFFensive Api Tester — source-aware API security testing. Maps your API from code, proves source→sink paths on a code graph, executes tests with a Rust engine, and triages the results with AI. Documentation · Install · Usage · GitHub Action Authorized use only. Live runs send real...

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion The plugin does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks. Usage: usage: PoC.py -h -u URL -p PAYLOAD Essential Bloc...

CVE-2026-111804

The Apache Traffic Server experimental wasm plugin is vulnerable to a use-after-free flaw located in its transaction-close handler . Additionally, the plugin forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue impacts versions 10.0.0 through 10.1.4 and 10.2.0 . Af...

EUVD-2026-107490

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

EUVD-2026-107479

Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the...

CVE-2026-105944 Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life

Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the...

CVE-2026-105944

Apache Pulsar Manager is an unsupported web console for administering Apache Pulsar clusters that suffers from critical authentication and authorization flaws. In versions 0.3.0 and later , an unauthenticated user can create a superuser account, gain full administrative privileges, and take compl...

CVE-2025-7847-POC

CVE-2025-7847 Wordpress Plugin Authenticated Subscriber Arbitrary File Upload POC Wordpress Plugin AI Engine 2.9.3 - 2.9.4 Proof Of Concept Please note that this vulnerability can only be exploited if the “Public API” option is enabled, which is disabled by default, and no Bearer Token is...

CVE-2026-105942

This vulnerability affects Apache Pulsar versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5. The issue stems from two flaws in how the broker authorizes proxied requests. First, the broker sometimes authorizes the original principal using the proxy's authentication data instead of its ...

EUVD-2026-107477

When a configured proxy role sends a request to the broker on behalf of another user the original principal, the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its ow...

EUVD-2026-107476

Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles. Topic-level subscription operations, su...

CVE-2026-105937

Apache Pulsar is vulnerable to a missing authorization flaw in its shadow topics implementation. An authenticated user with tenant admin rights in one tenant can create or update a topic to bind it to a persistent source topic in a different tenant by setting the PULSAR.SHADOW_SOURCE property. Th...

EUVD-2026-107475

Apache Pulsar shadow topics PIP-180 are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOWSOURCE. The admin REST API accepts this property when creating a non-partitioned or...

OCI-Ansible-Fix-CVE-2026-31431

CVE-2026-31431 Ansible Remediation This playbook remediates CVE-2026-31431, also known as Copy Fail, on Linux instances in OCI. CVE-2026-31431 is a local privilege escalation issue in the Linux kernel algifaead implementation used by the AFALG userspace crypto API. This playbook applies the main...

EUVD-2026-107472

The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured input topics. The Functions Worker performs this publish with its own broker client, which authenticates with the Worker's configured...

CVE-2026-105935

The Apache Pulsar Functions Worker contains a vulnerability where a REST API endpoint for triggering functions publishes caller-supplied values to input topics without verifying if the caller has produce permissions for those specific topics. The worker uses its own broker-client credentials for ...

EUVD-2026-107471

The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics DELETE /admin/v2/persistent/tenant/namespace/topic/truncate. Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a...

CVE-2026-105934

The Apache Pulsar broker admin REST API contains a missing authorization check (CWE-862) when truncating partitioned topics via the DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate endpoint. While non-partitioned topics require tenant admin or superuser roles, the broker fails to...

CVE-2026-105932

The Apache Pulsar broker admin REST API contains a missing authorization check in endpoints for non-persistent topics (/admin/v2/non-persistent/{tenant}/{namespace}/{topic}/entryFilters). While persistent topics require specific authorization to manage entry filter policies, these non-persistent ...

EUVD-2026-107469

The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these endpoints check that the caller is authorized for the entry filters topic policy operation. The corresponding endpoints for non-persistent...