13426 matches found
OpenCTI Auth Bypass (CVE-2026-27960)
CVE-2026-27960 in OpenCTI 6.6.0 through 6.9.12: authenticateUserByTokenOrUserId looks up users by bearer token without verifying it equals apitoken. The compile-time admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f authenticates as admin on every deployment. !/usr/bin/env python3 -- coding:...
LiteLLM CVE-2026-42208 Blind SQLi Detect
Detects CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: failed-auth logging passes the raw Authorization bearer into a virtual-key SQL lookup. Probes POST /v1/chat/completions with x'-prefixed pgsleep payloads never sk- and requires delay scaling plus a fast sk- control to rule out...
SiYuan CVE-2026-66012 MCP Auth Bypass Detect
Detects CVE-2026-66012 in SiYuan kernel 3.7.0 = v 3.7.2: POST /mcp on the Publish port default 6808 accepts anonymous RoleReader JWTs when Publish auth is disabled, exposing MCP tools including workspace file read without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SiYuan...
WordPress Core XSS2Shell RCE (CVE-2026-64638)
Exploits CVE-2026-64638 in WordPress Core 4.7.0 through 7.0.2: a striptags/KSES parser differential on /wp-login.php injects live DOM id=ajaxurl clobber. Default mode confirms the unauthenticated XSS primitive. With SERVE=true, hosts the full chain Application Password theft - REST - plugin uploa...
Exploit for CVE-2026-64638
💥 CVE‑2026‑64638 – WordPress XSS2Shell S...
Exploit for CVE-2026-64638
XSS2Shell Alert PoC CVE-2026-64638 WordPress Pre-Auth Ref...
xss2shell
XSS2Shell CVE-2026-64638 pre-auth reflected XSS on...
CVE-2026-54338
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...
CVE-2026-46405 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
CVE-2026-46358
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...
CVE-2026-46358 OpenBao's Inline Auth Incorrectly Redacted Headers
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...
EUVD-2026-54653
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...
UBUNTU-CVE-2026-19017
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...
Insertion of Sensitive Information Into Sent Data
Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the gh auth status process. An attacker can obtain partial authentication token values by accessing terminal or CI output where the process was executed. This is only exploitable if ...
CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...
CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...
Exploit for CVE-2026-64638
XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...
CVE-2026-17593
An account holding the nexus:settings:update permission in Nexus Repository 3 or the equivalent nexus:settings permission in the legacy Nexus Repository 2 could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of...
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
WordPress has fixed a pre-authentication reflected cross-site scripting XSS flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an...