CVE-2026-76706 Unauthenticated Information Disclosure in EdgeConnect SD-WAN Orchestrator API allows exposure of sensitive data

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could result in the disclosure of security-relevant configuration details and security feature status, whic...

Open WebUI < 0.9.5 - Information Disclosure

Open WebUI 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication. id: CVE-2026-45397 info: name: Open...

CVE-2024-9014

CVE-2024-9014 - pgAdmin 4 OAuth2 認証バイパス エクスプロイトツール このリポジトリには、pgAdmin 4 の CVE-2024-9014 脆弱性を検出および悪用するためのツールが含まれています。この脆弱性により、攻撃者は OAuth2 認証をバイパスして機密リソースにアクセスできる可能性があります。 ツール 1. cve20249014check.py このスクリプトは、pgAdmin 4 のインストールを調査し、公開された OAuth2 設定を探すことで、対象システムが CVE-2024-9014 に対して脆弱かどうかをチェックします。 使用方法...

nuclei-CiscoRV320Dump-CVE-2019-1653

Cisco Router Configuration Exposure Vulnerability 취약점 설명 이 저장소는 특정 Cisco 라우터에서 config.exp 구성 파일이 공개적으로 접근 가능한 URL을 통해 노출되는 취약점의 악용 과정을 자세히 설명합니다. 이 파일에는 자격 증명USERNAME 및 PASSWD, 네트워크 구성 및 기타 중요한 시스템 세부 정보를 포함한 민감한 정보가 포함될 수 있습니다. 인증 없이 접근 가능할 경우 장치 및 해당 장치가 배포된 네트워크의 보안을 손상시킬 수 있습니다. 관련 CVE 이 취약점은...

CVE-2020-13937

CVE-2020-13937 1. 취약점 설명: Apache Kylin에는 인증 없이 설정 정보를 노출하는 restful api가 있습니다. 2. 재현 취약점이 있는 경우 비교 취약점이 없는 경우 비교 PoC 작성 올바른 단일 URL 확인: pocsuite -r CVE-2022-26134.py -u url 오류 단일 URL 확인: pocsuite -r CVE-2022-26134.py -u url 배치 스캔: pocsuite -r CVE-2022-26134.py -u url.txt...

CVE-2020-13937

설명 Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha에는 인증 없이 Kylin의 구성 정보를 노출하는 하나의 restful api가 있습니다. 따라서 일부 기밀 정보 항목이 모든 사람에게...

CVE-2026-89175 Kingdom Communication Associated｜Smart Video Intercom System - Client-Side Authentication

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

CVE-2026-76963

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

CVE-2026-76963 Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

CVE-2026-82684

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior contain a Missing Authorization flaw that could allow an attacker to extract system credentials, configurations, or flash contents. The device is deployed in critical manufacturing and energy sectors . This CVE is part of a group of three ...

CVE-2026-84676

Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2026-84658

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

EUVD-2026-69723

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.ph...

Linux Distros Unpatched Vulnerability : CVE-2026-75329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full...

CVE-2026-51654

Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain schedule or scheduled-reboot configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-59284

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier...

CVE-2026-47894 Spring Cloud Config Server Native Environment Repository Exposure

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

CVE-2026-47894

Spring Cloud Config Server is vulnerable to directory traversal via its native environment repository, allowing an attacker to access sensitive configuration files outside the intended repository path by sending crafted requests. The affected versions span multiple release lines: 5.0.0–5.0.4, 4.3...

EUVD-2026-66803

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

CVE-2026-75329

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...