cve-2024-41110-checker

Verificador de Segurança Docker CVE-2024-41110 Esta ferramenta foi projetada para verificar múltiplos hosts em busca de vulnerabilidades relacionadas ao CVE-2024-41110 em instalações Docker. Ela verifica especificamente versões vulneráveis do Docker e o uso de plugins AuthZ, que podem...

CVE-2023-34035-Poc

CVE-2023-34035: Autorizzazione errata...

merge-authz-test

merge-authz-test authz 测试（CVE-2026-1999 关联漏洞）...

CVE-2024-41110-SCAN

CVE-2024-41110 Средство проверки безопасности Docker Этот инструмент предназначен для проверки хоста на наличие уязвимости, связанной с CVE-2024-41110, в установках Docker. Он специально ищет уязвимые версии Docker и использование плагинов AuthZ, которые потенциально могут привести к проблемам...

CVE-2026-34040-PoC

CVE-2026-34040 — Docker/Moby AuthZ-Plugin-Bypass Lab-PoC KO: Ein Projekt zur Reproduktion einer Schwachstelle für Übungszwecke, die die Autorisierungs-AuthZ-Plugins von DockerMoby mithilfe eines über 1 MB großen Anforderungsrumpfs umgeht. EN: Eine Laborreproduktion einer Schwachstelle, die Docker...

K000163072: Moby vulnerability CVE-2026-34040

Security Advisory Description Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins AuthZ. This issue has been patched in version 29.3.1. CVE-2026-34040 Impact There is no impact; F5...

CVE-2026-33186

CVE-2026-33186 gRPC-Go RBAC Authorization Policy Bypass via Missing :path Slash Auth Bypass Beschreibung Das authz-Paket in google.golang.org/grpc implementiert eine RBAC-Autorisierung auf SDK-Ebene unter Verwendung von Deny- und Allow-Regeln, die gegen den :path-Pseudo-Header abgeglichen werden...

CVE-2026-55106 authentik: Unauthenticated LDAP directory data disclosure

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.2.6, <=1.4.11), com.github.vzakharchenko:cisco-radius-plugin (>=1.2.5, <=1.4.11) +54 more potentially affected by CVE-2026-18203 via org.keycloak:keycloak-authz-policy-common (>=2.0.0.cr1, <=26.7.1)

org.keycloak:keycloak-authz-policy-common MAVEN version =2.0.0.cr1, =1.2.6, =1.2.5, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =24.3.0.0, =24.3.0.0, =2.5.6-24.0, =0.1.0, =8.1, =1.0.0, =1.1.0 and more Source cves: CVE-2026-18203 Source advisory:...

CVE-2026-17039

A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without...

SUSE SLES15: docker-stable / docker-stable-bash-completion / etc (SUSE-SU-2026:2579-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2579-1 advisory. - CVE-2026-33997: Fixed privilege validation bypass during plugin bsc1265907. - CVE-2026-34040: Fixed Authz zero length regression...

CVE-2026-47203 Authelia Missing Username Canonicalization in Basic Auth (LDAP)

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on SSO for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth i.e via the Authorization header with the Basic scheme on t...

CVE-2026-47339

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0. Users are recommended to upgrad...

CVE-2026-47339

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0. Users are recommended to upgrad...

CVE-2026-47339 Apache APISIX: authz-casdoor incorrect session sharing

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0. Users are recommended to upgrad...

PT-2026-50886

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.14.1 through 3.16.0 Description An incorrect authorization issue exists in the authz-casdoor plugin when using the default configuration. This allows an attacker to authenticate using credentials from a different sourc...

Astra Linux – Vulnerability in Subversion

The Subversion’s modauthzsvn module will crash if the server uses in-repository authz rules with the AuthzSVNReposRelativeAccessFile option, and a client sends a request for a non-existent repository URL. This can cause disruptions for users of the service. This issue has been fixed in...

Exploit for CVE-2026-33186

CVE-2026-33186 gRPC-Go RBAC Authorization Policy Bypass via M...

CVE-2026-33186

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory...

MiracleLinux 7 : pki-core-10.5.1-13.1.el7 (AXSA:2018-3231:02)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3231:02 advisory. pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access CVE-2018-1080 Tenable has extracted the preceding...