172926 matches found
CVE-2026-79672 Ech0 before 4.4.3 Authentication Bypass via Comment Panel
Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...
CVE-2026-79668 Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation
Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...
CVE-2026-79668
Ech0 versions before 4.7.3 contain an authentication bypass in the PUT /api/echo/like/:id endpoint. The endpoint lacks both identity verification and rate limiting, allowing unauthenticated attackers to repeatedly increment the fav_count field for any known echo identifier. This can arbitrarily i...
CVE-2026-79668 Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation
Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...
EUVD-2026-65446
Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...
CVE-2026-79667 Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement
Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...
CVE-2026-79667 Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement
Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...
CVE-2026-79667
Ech0 versions 4.3.4 and earlier fail to enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Endpoints such as /api/inbox, /api/panel/comments, and /api/backup/export authorize based only on the user's admin role, omitting scope checks. The backup export ...
CVE-2026-78863
A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfatoken Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...
CVE-2026-53561
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...
CVE-2026-78863 liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication
A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfatoken Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...
CVE-2026-78863 liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication
A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfatoken Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...
EUVD-2026-65468
A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfatoken Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...
CVE-2026-78863
liketrek TREK (versions up to 3.0.22 ) contains an improper authentication vulnerability in the Pre-2FA mfa_token Handler component, specifically in the loginUser function within server/src/services/authService.ts. A remote attacker with low privileges can exploit this flaw to achieve partial com...
cve-2025-29927-lab
Questo repository contiene un'applicazione web deliberatamente vulnerabile realizzata con Next.js. È progettata per dimostrare e studiare il problema di sicurezza noto come CVE-2025-29927. L'obiettivo di questo progetto è aiutare ricercatori di sicurezza, studenti e cacciatori di bug bounty a...
hunt-for-cve-2018-10933
البحث عن واستغلال تجاوز المصادقة في libSSH CVE-2018-10933 دليل عملي يشرح كيفية إيجاد المضيفين المعرضين لتجاوز المصادقة في libSSH CVE-2018-10933 وكيفية استغلالهم للحصول على وصول شل. يرجى الرجوع إلى المقالة التالية للحصول على التعليمات: https://www.marcolancini.it/2018/blog-libssh-auth-bypass/...
CVE-2026-75037
Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566...
CVE-2026-53561
Apache Hive 4.0.0–4.2.0 contains an improper authentication vulnerability in HiveServer2's SAML bearer-token validation. The flawed code in ThriftHttpServlet.java (doSamlAuth) and HiveSamlAuthTokenGenerator.java accepted attacker-supplied bearer tokens during SAML HTTP authentication without prop...
CVE-2026-53561 Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...
EUVD-2026-65394
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...