Rocky Linux 10.2 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2026_19135)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619135 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go:...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_11411)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202511411 advisory. kernel: media: uvcvideo: Remove dangling pointers CVE-2024-58002 kernel: sunrpc: handle SVCGARBAGE during svc auth processing as auth error CVE-2025-38089...

EUVD-2026-70988

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers...

confusploit

이 스크립트는 CVE-2022-26134에 취약한 서버를 찾기 위한 것이며 SHODAN CLI 및 Bash 스크립팅 원라이너와 함께 사용할 수 있습니다. 법적 및 교육 목적으로만 사용하십시오 OGNL 주입을 통한 Confluence 사전 인증 원격 코드 실행 CVE-2022-26134 2022년 6월 2일, Atlassian은 Confluence Server 및 Data Center 애플리케이션에 대한 보안 권고를 발표했으며, 치명적인 심각도의 인증되지 않은 원격 코드 실행 취약점을 강조했습니다. OGNL 주입 취약점으로 인해...

EUVD-2026-89365

Russh: Configured server auth-attempt cap is not enforced in the USERAUTHREQUEST runtime path...

Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

Details Affected versions and vulnerable location - Confirmed present on default branch main at HEAD 0089c89c94753bebbec12b956c07a1cd38740379. - Crate version at HEAD: 0.62.4. - Vulnerable locations on current default branch: - russh/src/server/mod.rs:91 pub maxauthattempts: usize -...

DEBIAN-CVE-2026-101283

iperf3 3.20–3.21 esnet/iperf has a pre-auth heap buffer overflow in decryptrsamessage: a 256-byte RSA buffer is BIOread with the attacker-controlled ciphertext length guard warns only, so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22...

CVE-2026-101283

iperf3 3.20–3.21 esnet/iperf has a pre-auth heap buffer overflow in decryptrsamessage: a 256-byte RSA buffer is BIOread with the attacker-controlled ciphertext length guard warns only, so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22...

CVE-2026-101283

The iperf3 network testing tool (versions 3.20–3.21 by esnet/iperf) is vulnerable to a pre-auth heap buffer overflow within the decrypt_rsa_message() function. The root cause is that a 256-byte RSA buffer is populated using BIO_read with an attacker-controlled ciphertext length; while a guard pro...

rsync: rsync: Authorization bypass via `auth users` directive parsing

An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain...

CVE-2025-32432-exploit-by-P34NUT

CVE-2025-32432 — Craft CMS 사전 인증 RCE 익스플로잇 작성자: P34NUT2 취약점: Craft CMS의 원격 코드 실행 사전 인증 CVE: CVE-2025-32432 대상: 모든 취약한 Craft CMS 인스턴스 3.x / 4.x / 5.x — Hack The Box: Orion에서 테스트됨 ⚠️ 면책 조항 이 도구는 Hack The Box, TryHackMe 또는 본인이 소유하거나 테스트에 대한 명시적 서면 허가를 받은 사설 랩 환경과 같은 통제된 환경 내에서 오직 교육 목적 및 승인된 침투 테스트 를...

CVE-2021-33044

CVE-2021-33044 Dahua IPC/VTH/VTO 장치 인증 우회 익스플로잇 설명: 일부 Dahua 제품에서 로그인 과정 중 발견된 신원 인증 우회 취약점입니다. 공격자는 악성 데이터 패킷을 구성하여 장치 신원 인증을 우회할 수 있습니다. python3 dahuaexploit.py --ip IP --port PORT...

CVE-2026-55181

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...

CVE-2026-55181 Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...

CVE-2026-55181 Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...

CVE-2026-55181 Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...

CVE-2026-55181

Prior to version 1.30.3 , Tugtainer (a self-hosted app for automating Docker container updates) contains a vulnerability where OIDC authentication can be initiated even when OIDC_ENABLED=false. While the /auth/oidc/enabled endpoint correctly reports that OIDC is disabled, a direct request to /aut...

EUVD-2026-90192

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...

CVE-2024-21762

CVE-2024-21762 - FortiGate SSL VPN RCE 탐지 및 익스플로잇 도구 CVE-2024-21762 - FortiGate SSL VPN의 심각한 취약점 탐지 및 익스플로잇 도구 ⚠️ 법적 고지 : 이 도구는 승인된 테스트 환경에서만 사용해야 합니다. 승인되지 않은 시스템에서의 사용은 불법 이며 심각한 법적 결과를 초래할 수 있습니다. 개요 CVE-2024-21762는 FortiGate SSL VPN 구성 요소의 심각한 취약점으로, 사전 인증 원격 코드 실행RCE을 허용합니다. 이 결함은...

CVE-2026-55176 Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth and authenticateWorkspaceHttp — accept the global CONTAINERSHAREDSECRET as a bearer token without verifying which...