Security Bulletin: Langflow OSS is affected by multiple vulnerabilities

Summary Langflow OSS is affected by multiple vulnerabilities that could allow a remote attacker to bypass authentication controls, execute arbitrary code, expose application programming interface API credentials, or disclose information through vulnerable dependencies. Issues include an incomplet...

CVE-2025-41646---Critical-Authentication-Bypass-

CVE-2025-41646---Critical-Authentication-Bypass- CVE-2025-41646 - Critical Authentication bypass 🔓 CVE-2025-41646 - RevPi WebStatus Authentication Bypass PoC A critical authentication bypass vulnerability CVE-2025-41646 in RevPi WebStatus ≤ v2.4.5 allows an attacker to log in as admin without val...

React4Shell

React2Shell Exploit Proof of Concept PoC for React Server Components RSC / Next.js Remote Code Execution vulnerability. Description A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following...

CVE-2019-20933

LAB 5-CVE-2019-20933 I. SYSTEM ANALYSIS Identifying the Attack Surface Starting with what is running in the environment. I list all active containers: docker ps The victim exposes a single port:8086. Currently, I do not have detailed information about the target. From the docker ps output, the...

CVE-2026-53576

Kestra Unauthenticated RCE Exploit CVE-2026-53576 Critical Authentication Bypass leading to Unauthenticated Remote Code Execution Exploit • Vulnerability Details • Impact • Remediation ⚠️ DISCLAIMER This tool is for educational and authorized security testing purposes only. DO NOT use this against...

CVE-2026-29000---pac4j-jwt-Authentication-Bypass-PoC

CVE-2026-29000 - pac4j-jwt Authentication Bypass PoC Note: This is not my original work. I am keeping this here for a reference. Working methodology: python3 exploit.py http://IP:PORT Fetching JWKS... + Got RSA public key kid: enc-key-1 Crafted PlainJWT with sub=admin, role=ROLEADMIN + Forged JWE...

CVE-2026-54088-poc

CVE-2026-54088: Command Injection via Authentication Hook Shell Substitution Pre-Authentication RCE Description This repository contains a Proof of Concept PoC for CVE-2026-54088, a critical OS Command Injection vulnerability in File Browser versions = 2.63.5. The vulnerability exists in the Hook...

cve-2025-29927-nextjs

Himalaya Tech Admin Panel — CVE-2025-29927 Demo WARNING: This application is intentionally vulnerable. For educational and authorized security research purposes only. Do NOT deploy to a public server. About This Demo This app demonstrates CVE-2025-29927 , a critical authentication bypass...

threat-intel-brief-cve-2026-42208-litellm

Threat Intelligence Brief - CVE-2026-42208: BerriAI LiteLLM SQL Injection CVE: CVE-2026-42208 GHSA: GHSA-r75f-5x8p-qvmc CVSS Score: 9.3 Critical Affected Software: BerriAI LiteLLM versions = 1.81.16, 1.83.7 Fixed Version: 1.83.7-stable released April 19, 2026 CISA KEV Added: May 08, 2026 Sources:...

CVE-2026-41940

CVE-2026-41940 | cPanel/WHM Authentication Bypass Detection ╔════════════════════════════════════════════════════════════════════════════╗ ║ cPanel/WHM Authentication Bypass - Detection Artifact Generator ║ ╚════════════════════════════════════════════════════════════════════════════╝ 📌 Descripti...

CVE-2026-41089-LongLogon

LongLogon · CVE-2026-41089 LongLogon is an unauthenticated, non-destructive precondition checker for CVE-2026-41089 , a pre-auth stack buffer overflow in the Windows Netlogon service. With no credentials, and without sending the overflow, it reports whether a domain controller's DNS domain name i...

smart-sketcher-upload

smART Sketcher 2.0 - Bluetooth Authentication Bypass CVE-2026-0842 | Missing Authentication on BLE Interface Overview The smART Sketcher 2.0 is a Bluetooth-enabled toy projector that lets kids trace images. It has no authentication on its Bluetooth connection - anyone within range can connect and...

skf-cli

SKF-CLI Discontinued About SKF Lab is a project from @blabla1337, Powered by OWASP, SKF-CLI is not a official release from OWASP, it's a personal project from myself. No longer Supporting the project cause demo.skflabs changed it's domain and added authnication $ python3 skf.py --help ╔═╗╦╔═╔═╗...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass CVSS 9.8 Critical — Authentication Bypass to Admin Account Takeover Description CVE-2026-8181 is an Authentication Bypass vulnerability in the Burst Statistics WordPress plugin version 3.4.0 to 3.4.1.1. This plugin is used by 200,000+ WordPre...

CVE-2024-21413

CVE-2024-21413 This Python script is used to abuse the CVE-2024-21413 coined "MonikerLink" TryHackMe Room: MonikerLink Assumptions This PoC has been created for a lab environment which means the server needs to be configured in a specific setting i.e. TLS authentication is not supported for...

cve-2026-29145

CVE-2026-29145 — OCSP checks sometimes soft-fail even when soft-fail is disabled Discoverer: gregk4sec https://github.com/gregk4sec/cve Discovery Date: 2026-02-26 Affected Vendor: Apache Affected Product: Tomcat Severity: 9.1 CRITICAL CWE: CWE-287 Improper Authentication Status: Under Review /...

Oracle-mysql-CVE-2012-2122

MySQL Authentication Bypass Vulnerability CVE-2012-2122 When connecting to MariaDB/MySQL, the entered password is compared with the expected correct password. Due to improper handling, even if memcmp returns a non-zero value, MySQL may still consider the two passwords as identical. That is, as lo...

mailenable-cve-2022-36934

MailEnable CVE-2022-36934 Exploit Module Metasploit module for MailEnable's authentication bypass vulnerability CVE-2022-36934, leading to remote code execution. 📌 Features Exploits MailEnable's improper input sanitization in SMTP/POP3 Supports both x86 and x64 Windows targets No user interaction...

CVE-2026-30498

CVE-2026-30498 – CSRF Vulnerability AdminPanel 4.0 Overview CVE ID: CVE-2026-30498 Reserved by MITRE Discoverer: Mehdi Ben Hamou A Cross-Site Request Forgery CSRF vulnerability exists in the delete.php endpoint of AdminPanel 4.0. This vulnerability allows an attacker to trigger sensitive actions...

CVE-2021-45232

Apache APISIX Dashboard Unauthorized Access Vulnerability CVE-2021-45232 FOFA Query title="Apache APISIX Dashboard" Affected Scope Apache APISIX Dashboard 2.10.1 POC: IP:PORT/apisix/admin/migrate/export Remediation Suggestions Upgrade to the latest security version Apache APISIX Dashboard 2.10.1:...