watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452

watchTowr-vs-Citrix-Netscaler-PreAuth-RCE Генератор детектирующих артефактов для Citrix NetScaler CVE-2026-8452 Технические подробности см. в нашем посте в блоге. Детектирование в действии python3 watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py --target https://172.16.5.12:9443/ / | | |\ \ \ / / \ ...

confusploit

Это скрипт для поиска уязвимых серверов к CVE-2022-26134, который можно использовать вместе с SHODAN CLI и Bash-скриптовым однострочником Пожалуйста, используйте только в законных и образовательных целях Confluence Pre-Auth Remote Code Execution через OGNL-инъекцию CVE-2022-26134 2 июня 2022 года...

CVE-2026-107281

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP/1.1 connection-pool key excludes the authenticated principal for connection-oriented NTLM and Negotiate authentication. A pooled...

CVE-2026-107279 AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107279

The AsyncHttpClient (AHC) library, used by Java applications for asynchronous HTTP requests, is vulnerable in version 3.0.12 . The root cause is that a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. Specifically, AuthenticatorUtils.computeExpectedR...

EUVD-2026-94638

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107279

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107279 AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107279 AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107279

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2025-32432-exploit-by-P34NUT

CVE-2025-32432 — Craft CMS 사전 인증 RCE 익스플로잇 작성자: P34NUT2 취약점: Craft CMS의 원격 코드 실행 사전 인증 CVE: CVE-2025-32432 대상: 모든 취약한 Craft CMS 인스턴스 3.x / 4.x / 5.x — Hack The Box: Orion에서 테스트됨 ⚠️ 면책 조항 이 도구는 Hack The Box, TryHackMe 또는 본인이 소유하거나 테스트에 대한 명시적 서면 허가를 받은 사설 랩 환경과 같은 통제된 환경 내에서 오직 교육 목적 및 승인된 침투 테스트 를...

EUVD-2026-92796

Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers...

GHSA-97RH-RHH2-7VJV Payload: Remote Code Execution through first-register

Impact A crafted request to the public first-register operation can be used to perform a RCE exploit. You are affected if: - You use local auth strategy and your application remains without an initial user created Patches In the patched version data submission to create first user is properly...

Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Impact The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be...

EUVD-2026-93990

Backstage: Insufficient audience validation in the Cloudflare Access auth provider...

GHSA-Q333-F498-W2X7 Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Impact The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be...

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Impact Several Passport-based authentication providers use shared OAuth profile normalization from @backstage/plugin-auth-node. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The...

GHSA-XM5Q-P7W3-X6CP Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Impact Several Passport-based authentication providers use shared OAuth profile normalization from @backstage/plugin-auth-node. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The...

EUVD-2026-93995

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization...

CVE-2021-33044

CVE-2021-33044 Dahua IPC/VTH/VTO devices auth bypass exploit Описание: Уязвимость обхода аутентификации идентификации, обнаруженная в некоторых продуктах Dahua в процессе входа в систему. Злоумышленники могут обойти аутентификацию устройства, формируя вредоносные пакеты данных. python3...