173220 matches found
VulnCheck KEV: CVE-2026-83549
Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...
VulnCheck KEV: CVE-2023-54391
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
PT-2026-84529
Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment VE versions 7.0 through 8.0 Description An authentication bypass exists in libpve-access-control that allows unauthenticated attackers to authenticate as any enabled user who does not have a second factor configured...
PT-2026-84199
Name of the Vulnerable Software and Affected Versions Manacle Technologies ERP affected versions not specified Description Improper authentication controls and inadequate file type validation at the API endpoint allow an unauthenticated remote attacker to upload arbitrary files to a web accessibl...
PT-2026-84430
Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A flaw in the underlying operating system of the software may allow an unauthenticated adjacent actor to bypass authentication controls. This could enable an attacker t...
PT-2026-84488
Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description An authentication issue in the management interface and API allows for improper authentication processing. An unauthenticated remote attacker can exploit this under specific conditions to bypa...
PT-2026-84494
Name of the Vulnerable Software and Affected Versions AOS-CX switches affected versions not specified Description An issue exists in the API endpoint of AOS-CX switches that may allow an unauthenticated remote actor to bypass authentication controls. Recommendations At the moment, there is no...
RHEL 9 : iscsi-initiator-utils (RHSA-2026:62029)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62029 advisory. The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as th...
PT-2026-84519
Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 Appliances affected versions not specified Description An OS Command Injection issue exists in the SMA1000 Appliance Management Console AMC. This occurs due to improper neutralization of special elements used in an OS command...
PT-2026-84539
Name of the Vulnerable Software and Affected Versions WWBN AVideo affected versions not specified Description Insufficient validation of password recovery token expiration occurs in the 'userRecoverPassSave.json.php' endpoint. This allows an attacker who has obtained a recovery token to use it...
PT-2026-84400
Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.6 Filament versions prior to 5.7.6 Description An issue exists in the handling of one-time codes for app-based multi-factor authentication MFA. The AppAuthentication::verifyCode function uses a cache key derived...
PT-2026-84285
Name of the Vulnerable Software and Affected Versions Cleo Harmony versions prior to 5.8.1.11 Description An issue exists in the SAML Authentication component where manipulation of the Email argument within the LocalUserUtil.getNativeUserByAssertions function allows for improper authentication...
PT-2026-84468
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Issues in the authentication module may lead to the improper processing of malformed or truncated input. An authenticated remote attacker can exploit this by...
POC-CVE-2026-0073
POC-CVE-2026-0073 ADB 认证绕过 — 概念验证 安全研究 PoC，作者 naheeju 安全公告： CVE-2026-0073 已于 2026-05-01 修复。 本 PoC 仅用于安全研究、漏洞分析和授权系统测试。 目录 免责声明 概述 本 PoC 演示内容 安全边界 环境要求 仓库结构 使用方法 构建 示例输出 验证失败 技术细节 证书处理 安全注意事项 负责任披露 研究理念 作者 ⚠️ 免责声明 本仓库包含一个为安全研究、漏洞分析、授权渗透测试和教育目的而创建的概念验证（PoC）。 仅测试您拥有或已获得明确许可评估的系统与设备。 此公开 PoC...
CVE-2026-24061-POC
CVE-2026-24061 - telnetd 认证绕过 PoC telnetd 中的严重认证绕过漏洞，可导致以 root 身份执行远程代码（RCE） 影响使用自 2015 年起即存在该漏洞的 telnetd 版本的系统 关于 该 PoC 演示了 CVE-2026-24061 ，这是一个存在于 telnetd 中的严重认证绕过漏洞，已潜伏 11 年未被发现。该漏洞源于 telnetd 登录进程对 USER 环境变量的不当处理。你可以查看引入该漏洞的那个著名提交 此处。 要求 受影响的 telnetd 版本：1.9.3 至 2.7 可访问目标 telnet 服务（例如默认端口 23）...
wp2shell-rce
WP2Shell RCE 一款评估与扫描工具，旨在检测单个端点或大型目标列表中的 WordPress Core 安装是否暴露于 WP2Shell 漏洞利用链。 ⚠️ 免责声明 仅可扫描您拥有或获授权评估的系统。 未经授权扫描或测试第三方系统属违法行为。维护者不对未经授权的使用或由此工具造成的间接损害承担任何责任或义务。 漏洞概述 WP2Shell 是一条严重的预身份验证远程代码执行（RCE）漏洞利用链，影响默认的 WordPress Core 安装，无需插件依赖或身份验证。 属性| 值 ---|--- 影响| 预身份验证远程代码执行（RCE） CVE 标识符| CVE-2026-63030...
EUVD-2026-66218
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...
CVE-2026-82919
A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function createapp of the file views.py of the component edit Endpoint. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and...
CVE-2026-82906
A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possibl...