EUVD-2026-75289

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770

Keycloak 's Device Authorization Grant flow contains a flaw where the token redemption process does not verify whether a user account is currently locked due to brute-force protection . An attacker holding an active session for a locked account can complete the device login flow and obtain new se...

CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

Exploit for CVE-2026-53519

Lab CVE-2026-53519 - Nezha Dashboard pre-auth path traversal...

CVE-2026-82582

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...

Exploit for Missing Authentication for Critical Function in Splunk

CVE-2026-20253 Lab Environment Splunk Enterprise Pre-Auth R...

Exploit for SQL Injection in Osgeo Geoserver

Lab CVE-2023-25157 va CVE-2023-25158 Lab nay dung GeoServer/P...

CVE-2021-44228

Log4j Vulnerability - CVE-2021-44228 📗 Introduction This vulnerability was discovered on December 9, 2021, identified with CVE-2021-44228 , this flaw affects the java log package, generating a Severity Score CVSS of 10 points , providing execution of remote access to the host. This vulnerability...

Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key

Nearly one in ten of the internet-facing LiteLLM servers that Wiz Research scanned in February accepted sk-1234 , the example admin key in LiteLLM's own setup guide. LiteLLM is an open-source AI gateway, the software a company puts between its applications and the model providers it pays for. Tha...

CVE-2017-5638-PoC

CVE-2017-5638 Apache Struts 2 RCE Proof of Concept This repository contains a Proof of Concept PoC script demonstrating the Remote Code Execution RCE vulnerability identified as CVE-2017-5638 in Apache Struts 2. Vulnerability Details CVE ID: CVE-2017-5638 Affected Software: Apache Struts 2 versio...

Sooty

Overview Sooty is a tool developed with the task of aiding SOC analysts with automating part of their workflow. One of the goals of Sooty is to perform as many of the routine checks as possible, allowing the analyst more time to spend on deeper analysis within the same time-frame. Details for man...

wix-kickstartx-challenge-writeup

Wix KickstartX Challenge 2026 — Full Writeup Result: 200/200 100% — Token: WKX-9245FA70-200 Date: March 24, 2026 1. Discovery & Reconnaissance The Challenge Announcement A LinkedIn post announced a special challenge for Wix KickstartX — a junior developer program. The rules: 30 minutes, one...

WordPress ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by NumeX in WordPress Plugin Chat Help versions = 3.1.3...

vboxdie-cracker

Crackeador de contraseñas de cifrado de imágenes de disco de Virtual Box Requisitos 1. PHP = 5.5.0 2. OpenSSL = 1.0.1 soporte XTS Descripción del algoritmo La contraseña del usuario se almacena usando una combinación de PBKDF2 y AES-XTS de la siguiente manera los valores mostrados están fijos por...

CVE-2023-4294

CVE ID : CVE-2023-4294 Vulnerability Type : Cross-Site Scripting Description : The URL Shortify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the referrer header in versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes ...

WordPress WP Business Intelligence Lite plugin <= 3.2.0 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation vulnerability

Authenticated Subscriber+ Missing Authorization to Privilege Escalation vulnerability discovered by Nabil Irawan in WordPress Plugin Business Intelligence Lite versions = 3.2.0...

CTF-Web-Exploitation

Nether Portal Desync HUUP "I travel not on established roads but leap freely across the void. Package me wrong, and I'll deliver a secret to the wrong doorstep." Description The challenge features an HTTP/3 QUIC application layered over UDP. Because UDP is stateless and the proxy doesn't enforce...

CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32-

CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32- Usage Reverse shell listener with Ncat root@kitploit: root@Kali:/TryHackme/Ice nc -nlvp 443 listening on any 443 ... connect to 192.168.92.128 from UNKNOWN 192.168.92.133 49211 Microsoft Windows Version 6.1.7601 Copyright c...