CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

EUVD-2026-69557

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana...

libssh: libssh: denial of service via oversized SFTP read length

A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests...

CVE-2020-14295

CVE-2020-14295 Preuve de concept de CVE-2020-14295. L'article original se trouve sur exploit-db. Installer les dépendances root@kitploit: python3 -m pip install -r requirements.txt Utilisation root@kitploit: $ python3 cactisqlirce.py --help usage: cactisqlirce.py -h -t -u -p --lhost --lport Cacti...

CVE-2016-5734-docker

CVE-2016-5734-docker PhpMyAdmin 4.0.x—4.6.2 Vulnérabilité d'exécution de code à distance CVE-2016-5734 Installation root@kitploit: git clone https://github.com/miko550/CVE-2016-5734-docker.git cd CVE-2016-5734-docker docker compose up hhtp://localhost:8083 Exploitation root@kitploit: python3...

CVE-2026-84207

Heym before 0.0.98 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its WebSocket Send and WebSocket Trigger workflow nodes. The root cause is the failure to apply SSRF egress guards to these nodes, allowing authenticated users to craft workflow nodes with arbitrary URLs and h...

EUVD-2026-69295

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket...

EUVD-2026-69292

GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier th...

CVE-2026-84205 GROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval

GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier th...

CVE-2026-58571

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-79686

Dell PowerStore contains a Protection Mechanism Failure vulnerability that allows an authenticated user with limited privileges to bypass access restrictions and gain escalated privileges. The Dell-assigned CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicat...

CVE-2026-79684

Dell PowerStore contains a Protection Mechanism Failure vulnerability (CVE-2026-79684, CVSS 3.1 score 8.8 HIGH ). An authenticated user with limited privileges could bypass access restrictions to gain escalated privileges , with high impact on confidentiality, integrity, and availability over the...

CVE-2026-13337

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui...

CVE-2026-84196

Kyverno before 1.18.0 is affected by a server-side request forgery (SSRF) in the apiCall.service.url field. The root cause is variable substitution that allows authenticated users to inject user-controlled input, enabling arbitrary outbound HTTP requests to internal services, cloud metadata endpo...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 avant la version 11.3.757 est vulnérable à une injection HTML stockée dans le panneau d'administration CrushFTP Rapports / "Who Created Folder", permettant une exécution HTML persistante dans les sessions administrateur. CWE CWE-79 — Neutralisation incorrecte de l'entrée...

n8n-RCE-CVE-2025-68613

n8n CVE-2025-68613 Aperçu Ce dépôt contient un projet de recherche en sécurité à but éducatif axé sur CVE-2025-68613 , une vulnérabilité affectant des versions spécifiques de n8n liée à une évaluation non sécurisée d'expressions de workflow. Le projet a été testé uniquement dans un environnement ...

CVE-2019-14224

CVE-2019-14224: Exécution de code à distance authentifiée dans Alfresco Community En exploitant plusieurs composants des applications Alfresco Software, une chaîne d'exploitation a été observée qui permet à un attaquant d'exécuter du code à distance. L'attaquant doit utiliser Alfresco pour :...

CVE-2021-31630

CVE-2021-31630 OpenPLC 3 WebServer : exécution de code à distance authentifiée. Description La présence d'une injection de commandes dans Open PLC Webserver v3 permet à des attaquants distants d'exécuter du code arbitraire. Testé uniquement sur la machine HTB Wifinetictwo.htb. J'ai rencontré des...

Security Bulletin: IBM i is Affected By An Incorrect Authorization Vulnerability [CVE-2026-16941]

Summary IBM i is vulnerable to allowing a remote authenticated attacker to modify certain system messages CVE-2026-16941 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16941 DESCRIPTION: IBM i could allow a remote authenticated attacker to modify certain...

PT-2026-84388

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Deserialization of untrusted data in the machine learning component allows remote code execution through object injection. An attacker can use a specially crafted trained model artifact...