CVE-2026-18426 Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-1010-WebSocket-Connection-Smuggling-via-Malformed-Upgrade-Header

CVE-2026-1010 – WebSocket接続スマグリング 概要 リバースプロキシとバックエンドが、不正なWebSocketアップグレードヘッダーを含むHTTPリクエストの解析方法をめぐって不一致を起こします。プロキシはそれを1つのリクエストとして扱いますが、バックエンドは2つとして解釈し、攻撃者が隠れたリクエストをスマグリングできるようにします。これにより、キャッシュポイズニングやアクセス制御のバイパスが発生する可能性があります。 脆弱性の詳細 タイプ: 接続スマグリング / リクエスト分割 影響: 内部エンドポイントへの不正アクセス、キャッシュポイズニング 根本原因:...

thm-Moniker-Link-cve-2024-21413-writeup

TryHackMe: Moniker Link CVE-2024-21413 パス: Cyber Security 101 → Exploitation Basics → Moniker Link CVE-2024-21413 難易度: Premium room フォーカス: Outlook の Protected View バイパス、NTLM ハッシュの漏洩、Responder による認証情報のキャプチャ CVE-2024-21413 は、Microsoft Outlook が細工されたハイパーリンクを処理する方法に影響を与える重大な脆弱性です。file:// Moniker Link...

CVE-2026-88899

CVE-2026-88899 - Knowns 0.30.0 未認証ヘッダーインジェクションによりAIエージェントがホストファイルシステムへ無制限にアクセス可能 概要 Knownsの組み込みOpenCode...

CVE-2026-89027

miniOrange JWT Authentication for WP REST APIs plugin for WordPress (before 4.8.0 ) contains an authentication method downgrade vulnerability. An unauthenticated attacker can supply a specific GET parameter that bypasses capability checks and nonce verification, forcing the plugin to use Basic HT...

EUVD-2026-79746

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

GHSA-CP4Q-FQW9-4HF6 Http4s Ember HTTP/2: unbounded continuation frame accumulation

When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without the ENDHEADERS flag, it buffers the header block fragment and waits for subsequent CONTINUATION frames. These accumulate unbounded until the connection closes. Impact A remote, unauthenticated peer can exhaust the heap on any Embe...

Http4s Ember HTTP/2: unbounded continuation frame accumulation

When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without the ENDHEADERS flag, it buffers the header block fragment and waits for subsequent CONTINUATION frames. These accumulate unbounded until the connection closes. Impact A remote, unauthenticated peer can exhaust the heap on any Embe...

Boost Engagement with Free Passkeys by Wordfence

Imagine you can sign in with one click. Now imagine all the users on your WooCommerce store or WordPress powered website can sign in with one click. Firstly it makes your life a lot easier. But more importantly, you’ve removed friction from users logging in to make purchases, to engage in your...

GHSA-9XWW-74XV-GJFP Http4s: DigestAuth allows replay of captured requests

The DigestAuth replay defence stores lastNc + 1 rather than the nonce-count nc value it just accepted. When a legitimate client sends non-contiguous nc values parallel or retried requests, as browsers do, the server's counter lags behind the highest nc seen, and a captured Authorization header ca...

Http4s: DigestAuth allows replay of captured requests

The DigestAuth replay defence stores lastNc + 1 rather than the nonce-count nc value it just accepted. When a legitimate client sends non-contiguous nc values parallel or retried requests, as browsers do, the server's counter lags behind the highest nc seen, and a captured Authorization header ca...

GHSA-9998-894R-FWVR Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

Summary Ember's HTTP/1.1 header parser matches the Transfer-Encoding header value with a case-sensitive substring test hValue.contains"chunked". RFC 9112 §7 requires transfer-coding names to be compared case-insensitively. A request carrying Transfer-Encoding: Chunked capital C is therefore not...

Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

Summary Ember's HTTP/1.1 header parser matches the Transfer-Encoding header value with a case-sensitive substring test hValue.contains"chunked". RFC 9112 §7 requires transfer-coding names to be compared case-insensitively. A request carrying Transfer-Encoding: Chunked capital C is therefore not...

Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Summary Ember's HTTP/1.1 request parser does not reject a message that carries both a Transfer-Encoding and a Content-Length header. RFC 9112 §6.1 requires a server to treat such a message as a framing error and close the connection. An intermediary that follows the RFC's CL-strip-and-forward pat...

GHSA-8H4C-X2WG-6XP8 Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Summary Ember's HTTP/1.1 request parser does not reject a message that carries both a Transfer-Encoding and a Content-Length header. RFC 9112 §6.1 requires a server to treat such a message as a framing error and close the connection. An intermediary that follows the RFC's CL-strip-and-forward pat...

CVE-2026-15826-CVE-2026-15748

CVE-2026-15826, CVE-2026-15748 寄付 PayPal、または以下のQRコードをスキャンして、このプロジェクトの維持を支援してください。 ⚡ 簡単な使い方 このプロジェクトは、以下のような安全かつ許可された環境でのみ使用してください。 ローカル仮想マシン Dockerコンテナ 隔離されたラボ環境 許可されたペネトレーションテスト環境 セットアップ例： root@kitploit: git clone cd Project use python follow below Create a virtual environment python -m venv ven...

Tencent MSEC Path Traversal

RISK EVALUATION The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. 2. RECOMMENDED...

GHSA-RF68-8GJR-36Q7 Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty

Summary Nezha v2.2.3 regresses the GHSA-9rc6-8cjv-rcvx host header injection fix for deployments where the new dashboardhost setting is empty. In that configuration, /api/v1/oauth2/provider again reflects the request Host header into the OAuth2 redirecturi sent to the identity provider, even if...