CVE-2026-94212 Apache APISIX: unauthenticated impersonation issue in saml-auth

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

hotpot

Hotpot 🍲 Authy / Google Authenticator のコマンドライン版。 Hotpot は、TOTPベースの二要素認証コードを管理する、シンプルで安全なコマンドラインツールです。2FAのシークレットをシステムのキーリングに安全に保存し、必要なときに時間ベースのワンタイムパスワードを生成します。 セキュリティ、パフォーマンス、信頼性のために Rust で構築されています。 特徴 安全な保存 : システムキーリング（Keychain/libsecret/Credential Manager）を使用 TOTP RFC 6238 コード生成:...

BIT-RABBITMQ-2026-67234 RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the...

BIT-RABBITMQ-2026-67230 RabbitMQ: Web-STOMP unbounded pre-auth accumulation

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither maxframesize nor logintimeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frame...

BIT-RABBITMQ-2026-66069 RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...

auth-header-trust-rules

auth-header-trust-rules 攻撃者が制御できる HTTP リクエストヘッダーに基づいて認証・認可・信頼の判断を行うコードを検出する、小さな Semgrep ルールパックです。 この脆弱性クラスの代表的な例が CVE-2025-29927 です。Next.js はミドルウェアを実行するかどうかの判断に x-middleware-subrequest ヘッダーを信頼しており、 細工された値を送り込んだインバウンドリクエストはミドルウェアを完全にスキップできました。 同様の形は、さまざまなフレームワークやエコシステムで繰り返し発生しています。 このパックには、2...

FULL-ANALYSIS---CVE-2026-45829-ChromaDB-

CVE-2026-45829 - ChromaDB Pre-Auth RCE CVSS 10.0 ⚠️ 警告 このリポジトリには、CVE-2026-45829 の動作する PoC が含まれています。 許可された管理環境でのテストのみを目的としています。 説明 ChromaDB バージョン 1.0.0 から 1.5.8 の重大な脆弱性により、認証されていない攻撃者が trustremotecode=true を使用して Hugging Face から悪意のあるモデルをロードすることで、任意のコードを実行できます。 PoC の使用方法 リスナーの準備 nc -lvnp 4444...

CVE-2022-3294

エクスプロイト参照: https://github.com/kubernetes/kubernetes/issues/113757 https://github.com/kubernetes/kubernetes/issues/119640 https://github.com/kubernetes/sig-security/blob/main/sig-security-external-audit/security-audit-2021-2022/findings/Kubernetes%20v1.24%20Final%20Report.pdf 列挙: 1...

AndroidAuto

Open Android Auto Android Autoの電話側 アプリのオープンソース実装です。このアプリは携帯電話上で動作し、USB経由で車のヘッドユニットに投影し、Googleの独自規格であるcom.google.android.projection.gearhead APKを置き換えます。 ⚠️ 作業中 このプロジェクトは初期開発段階にあります。プロトコルハンドシェイクと動画投影は実際のヘッドユニットで動作しています。携帯電話の画面は、切断されるまで数秒間、車のヘッドユニットに正常に表示されます（動画の安定性は改善中です）。 機能 プロトコルと接続 USB...

CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 - 認証バイパス 管理者ユーザーとLDAP設定を抽出 - このPoCは読み取り専用アクションのみを行います。 エクスプロイトの実行 USE: python3 exploit.py https://target.com Ex: python3 exploit.py https://target.com nucleiテンプレートの実行 echo https://target.com | nuclei -t CVE-2022-40684.yaml...

cve-2026-43512-poc

CVE-2026-43512 — Apache Tomcat DIGEST 认证绕过 可利用性分析结果： 根本原因已确认。但针对标准 UserDatabaseRealm 部署，端到端利用不可复现 。详情请参见分析。 目录 概述 受影响版本 根本原因 分析 仓库结构 要求 使用方法 预期输出 参考 免责声明 概述 CVE-2026-43512 是 Apache Tomcat 的 HTTP DIGEST 认证机制中的一个漏洞。方法 RealmBase.getDigest 在构造 A1 哈希输入之前，未验证 getPasswordusername 的返回值。当用户名在已配置的 Realm...

Rocky Linux 10.2 [CIQ] Security Update: 389-ds-base / 389-ds-base-bdb / 389-ds-base-bdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_55424)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202655424 advisory. 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check CVE-2026-11770 389-ds-base: 389-ds-base: NULL pointer dereference ...

CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1778111838)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1778111838 advisory. - An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1790248981)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790248981 advisory. - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The...

CentOS Linux 6 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ssl Multiple Vulnerabilities (CENTOS6:CLSA-2026:1779297093)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1779297093 advisory. - Heap-based Buffer Overflow vulnerability in modproxyajp of Apache HTTP Server. If modproxyajp connects to a malicious AJP server this...

CentOS Linux 6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS6:CLSA-2026:1777463708)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1777463708 advisory. - A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used ...

Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc Multiple Vulnerabilities (crlsa-2022_5313)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225313 advisory. curl: OAUTH2 bearer bypass in connection re-use CVE-2022-22576 curl: credential leak on redirect CVE-2022-27774 curl: auth/cookie leak on redirect...

CentOS Linux 6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS6:CLSA-2025:1758896552)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1758896552 advisory. - In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled...

Rocky Linux 8 [CIQ] Security Update: 389-ds-base / 389-ds-base-debuginfo / 389-ds-base-debugsource / etc Multiple Vulnerabilities (crlsa-2026_55530)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202655530 advisory. 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check CVE-2026-11770 389-ds-base: 389-ds-base: NULL pointer dereference in...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_11411)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202511411 advisory. kernel: media: uvcvideo: Remove dangling pointers CVE-2024-58002 kernel: sunrpc: handle SVCGARBAGE during svc auth processing as auth error CVE-2025-38089...