CVE-2026-57219

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauthclientsecret, exposing credentials to unauthenticated callers when the...

EUVD-2026-43021

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauthclientsecret, exposing credentials to unauthenticated callers when the...

CVE-2026-57219

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauthclientsecret, exposing credentials to unauthenticated callers when the...

CVE-2026-57219

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauthclientsecret, exposing credentials to unauthenticated callers when the...

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

Summary SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension --...

CLSA-2026-1783705168 curl: Fix of CVE-2026-11856

CVE-2026-11856: flush cached HTTP Digest auth state when the origin or credentials change on the same easy handle so a challenge computed for one origin or set of credentials is not reused for another...

Malware in @genie-auth/config

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @genie-auth/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40bdd86a7980138025e445fc77dd743efbd9e7d9e76b25a24779facd15e16dc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @genie-auth/config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-59180 Apprise forwards configured auth headers across cross-origin HTTP redirects

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...

CVE-2026-59180

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...

CVE-2026-58207

A flaw was found in NATS Server. A client with the ability to send account-scoped connection monitoring requests could crash the server. This is achieved by providing pagination offset and limit values that cause an arithmetic overflow, leading to a Denial of Service DoS. Mitigation Upstream...

Palo Alto GlobalProtect CVE-2026-0257 auth override bypass

CVE-2026-0257: when GlobalProtect authentication override cookies are enabled and the encryption certificate is exposed via the HTTPS service, an attacker can retrieve the public key from the TLS chain and forge portal-userauthcookie values to bypass authentication on the portal or gateway...

Palo Alto GlobalProtect CVE-2026-0257 detection

Fingerprints Palo Alto GlobalProtect and flags PAN-OS versions affected by CVE-2026-0257 authentication override cookie forgery. Actual exploitability also requires authentication override cookies to be enabled and certificate reuse with the HTTPS service. !/usr/bin/env python3 -- coding: utf-8 -...

Apache Tomcat CVE-2026-43512 DIGEST authentication bypass

CVE-2026-43512: when DIGEST authentication is enabled, RealmBase.getDigest concatenates the literal string "null" for unknown usernames. A client digest computed with password="null" matches the server hash. Note: standard UserDatabaseRealm may still reject unknown users in getPrincipal;...

Apache Tomcat CVE-2026-43512 detection

Fingerprints Apache Tomcat and flags versions affected by CVE-2026-43512 DIGEST authentication bypass: 9.0.x 9.0.118, 10.1.x 10.1.55, 11.0.x 11.0.22, 8.5.x = 8.5.100. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from...

WinRM Authentication Enumeration

Probe WinRM /wsman and enumerate advertised authentication methods. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate WinRM authentication methods on ports 5985/5986.""" from future import annotations import json from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

Confluence Pre-Auth OGNL Detection

Safe fingerprint for Confluence OGNL injection surface CVE-2022-26134 indicator — no weaponized payload. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Confluence OGNL pre-auth indicators CVE-2022-26134 fingerprint.""" from kittysploit import from lib.protocols.http.httpclient import...

Gitea CVE-2026-20896 - X-WEBAUTH-USER reverse-proxy auth bypass

CVE-2026-20896: default Gitea Docker deployments = 1.26.2 ship with REVERSEPROXYTRUSTEDPROXIES = and accept X-WEBAUTH-USER from any source. An attacker can impersonate any user including admins on the web UI without a password or API token. !/usr/bin/env python3 -- coding: utf-8 -- import random...

EUVD-2026-42726

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to...