CVE-2026-70411

Dell Container Storage Modules (CSM) versions prior to 1.18.0 are vulnerable to a Missing Authentication for Critical Function vulnerability within the csm-authorization-tenant gRPC service (TenantService) . An unauthenticated attacker positioned on an adjacent network could exploit this flaw to ...

CVE-2026-63688

Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...

CVE-2026-61421

Dell Container Storage Modules, versions prior to 1.18.0, contains an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-105797

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

Nextjs-middleware-vulnerable-appdemo-CVE-2025-29927

ペネトレーションテスト練習用の脆弱なNext.jsアプリ これは、CVE-2025-29927（Next.jsミドルウェア認証バイパス脆弱性）に対して脆弱になるように意図的に設計されたNext.jsアプリケーションです。 ⚠️ 免責事項 このアプリケーションは教育および倫理的なハッキング目的のみで使用してください。 本番環境にデプロイしないでください。脆弱性は意図的に仕込まれており、セキュリティテストや練習のために使用されることを想定しています。 脆弱性の詳細 CVE ID: CVE-2025-29927 説明:...

CVE-2026-61421

Dell Container Storage Modules, versions prior to 1.18.0, contains an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-61421

Dell Container Storage Modules (CSM) versions prior to 1.18.0 are vulnerable to a Use of Hard-coded Cryptographic Key (CWE-798) in the karavi-authorization component's JWT authentication. An unauthenticated remote attacker who knows the publicly available signing secret can forge authentication t...

EUVD-2026-93437

Dell Container Storage Modules, versions prior to 1.18.0, contains an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-25197

CVE-2026-25197：通过用户可控密钥绕过授权（IDOR） 安全公告 字段| 值 ---|--- CVE| CVE-2026-25197 ICSA| ICSA-26-055-03（更新 A） CVSS 3.1| 9.1（严重） 向量| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-639（通过用户可控密钥绕过授权） 研究人员| Michael Groberman — Gr0m 发布日期| 2026-04-02（更新 A） 产品 字段| 值 ---|--- 厂商| Gardyn 产品| Gardyn Home Kit...

linux-kernel-codex-harness-v2

Kernel Codex Harness v2 한국어 | English 研究工具 · 原始导入：2026年4月3日 · v2 文档修订：2026年7月11日 外部信号：从注意力分配到溯源感知分类 使用可复现的观察结果引导模型注意力，然后使用仓库溯源组织审查队列——绝不用于声称证明。 项目谱系—— Kernel Codex Harness v1 · 注意力分配 → Kernel Codex Harness v2 · 溯源感知分类 项目状态。 本仓库是一个 LLM 辅助研究工具，将 v1 的注意力分配工作流发展为溯源感知分类，用于实际的 Linux 内核漏洞研究。此版本被用于发现以...

CVE-2026-63688

Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...

CVE-2026-63688

Dell Container Storage Modules (CSM) versions prior to v1.18.0 are vulnerable to a Missing Authentication for Critical Function flaw in the csm-authorization-storage gRPC server . An unauthenticated remote attacker can exploit this to gain unauthorized access to storage backend administrator cred...

EUVD-2026-93428

Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...

CVE-2025-29927

CVE-2025-29927 CVE-2025-29927：Next.js 中间件绕过漏洞 此仓库演示了 Next.js 中的 CVE-2025-29927 漏洞，其中内部标头 x-middleware-subrequest 可用于绕过诸如身份验证等中间件检查。 受影响版本 Next.js 15.x 15.2.3 Next.js 14.x 14.2.25 Next.js 13.x 13.5.9 缓解与修复 将 Next.js 升级到已修复的版本： Next.js 15.x 15.2.3 Next.js 14.x 14.2.25 Next.js 13.x 13.5.9 如果无法立即升级，请...

EUVD-2026-93426

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

CVE-2026-106040

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the cororpc master port can evict DISK replicas across all tenants,...

CVE-2026-106039

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the cororpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete wi...

CVE-2026-106041

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...

CVE-2026-73310

CVE-2026-73310: OAuth2 redirect URI not bound to authorization code XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued. What happens At the token endpoint, XenForo checks that the submitted redirecturi is somewhere in the client's...

CVE-2022-22978

CVE 2022-22978: RegexRequestMatcher 中的授权绕过 🥶 概述 根据我了解到的信息，这是一个与 Spring Security 框架中的 RegexRequestMatcher 类相关的漏洞。具体来说，那些使用 RegexRequestMatcher 且在正则表达式中包含点号 . 的应用程序，可以被 \r%0a 、\n%0d 这些字符绕过；从而攻击者无需身份验证即可访问不允许访问的路径。 Spring Security 框架中存在漏洞的版本： 5.5.x 早于 5.5.7 5.6.x 早于 5.6.4 更早的不受支持版本。 分析 我们需要访问 Spring...