CVE-2022-1388-rs

CVE-2022-1388-rs Scanner and Interactive shell for CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE written in Rust Summary To wrap things up here is an overview of the necessary conditions of a request for exploiting this vulnerability: Connection header must include X-F5-Auth-Token...

MCP-Inspector-CVE-2025-49596

MCP Inspector CVE-2025-49596 Vulnerability Checker This script checks if an MCP Inspector server is vulnerable to CVE-2025-49596, a security issue where the /sse endpoint responds to unauthenticated requests missing auth token. How It Works The script sends a GET request to the /sse endpoint of t...

Teamsniper

Teamsniper Teamsniper 是一款用于在 Microsoft Teams 中提取关键词（如密码、电子邮件、数据库等）的工具。 用法 帮助选项 root@kitploit: usage: Teamsniper.py -h -d DATABASE -a AUTHTOKEN -s SEARCH Teamsniper is a tool for fetching the given keywords in Microsoft Teams. options: -h, --help show this help message and exit -d DATABASE,...

CVE-2026-25253

CVE-2026-25253：OpenClaw 中通过认证令牌窃取实现一键 RCE 受影响软件： OpenClaw clawbot 法律免责声明： 本代码及分析文章仅供授权的安全研究和教育目的使用。在未经明确书面许可的情况下，针对系统使用此漏洞利用工具属于非法且不道德的行为。作者对任何滥用行为不承担任何责任。 技术背景 OpenClaw（前身为 Clawdbot ，早期版本中称为 Moltbot ）是一个在 macOS、Windows 或 Linux 上本地运行的 AI 助手框架。它支持 Anthropic 和 OpenAI 等云端模型，也支持本地模型。 Control UI...

CVE-2026-25253-research

CVE-2026-25253 Proof of Concept One-click RCE on OpenClaw via Cross-Site WebSocket Hijacking. DISCLAIMER: This code is provided for authorized security research and educational purposes only. Use of this code against systems without explicit written permission is illegal and unethical. The author...

Linux Distros Unpatched Vulnerability : CVE-2026-82255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlle...

CVE-2026-76179 Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

CVE-2026-76179

CVE-2026-76179 affects the Ebyte NE2-D11 and certain other Ebyte gateway products. The vulnerability stems from insufficient protection of authentication tokens used by the web management interface, specifically through the use of GET request methods with sensitive query strings during client-sid...

SUSE CVE-2026-68743

A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...

CVE-2026-71277

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...

CVE-2026-18817

CVE-2026-18817 affects Baserow up to 2.3.2. The issue involves the function BaserowImpersonateAuthTokenSerializer in backend/src/baserow/api/admin/users/serializers.py (Inactive Non-Staff User Handler). A manipulation may lead to improper authorization and, per the report, remote exploitation is ...

CVE-2026-68743

A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...

EUVD-2026-52865

A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...

CVE-2026-68743 Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1

A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...

CVE-2026-67435

The issue in linuxfabrik-lib affects the Python module lib.url.fetch() in versions before 6.0.0. It may follow cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, enabling a malicious redirect-capable server to receive headers such as X-...

PT-2026-65902

Name of the Vulnerable Software and Affected Versions linuxfabrik-lib versions prior to 6.0.0 Description The lib.url.fetch function follows cross-origin redirects while forwarding caller-supplied credential headers, excluding Authorization and Cookie. This behavior allows a malicious server...

Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea's API endpoint for creating Personal Access Tokens POST /users/username/tokens is protected by a middleware reqBasicOrRevProxyAuth that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in t...

CVE-2026-47393 PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...

GHSA-2V2F-MVFG-PH56 meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary AuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent. Because extracttokenfromheaders does not recognise the X-Pipeboard-Token header, an attacker who sends...

PT-2026-60896

Name of the Vulnerable Software and Affected Versions meta-ads-mcp versions prior to 1.0.115 Description An authentication bypass exists in the AuthInjectionMiddleware within the meta-ads-mcp package. The middleware only rejects requests when both auth token and pipeboard token are absent. Howeve...