CVE-2026-19685

NetworkManager failed to enforce the private_user restriction on the 802-1x.ca-path and phase2-ca-path directory-valued connection properties—an incomplete fix for CVE-2025-9615. An unprivileged local user can point a private WPA-Enterprise (802.1X) profile's CA path at an attacker-controlled dir...

CVE-2026-19685 Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

EUVD-2026-64957

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

CVE-2026-19685 Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

keycloak-cve-2026-18963-hunt

CVE-2026-18963: Keycloak account takeover, caccia alle tracce di sfruttamento Uno script psql che cerca in un database PostgreSQL di Keycloak le tracce dello sfruttamento di CVE-2026-18963 account takeover non autenticato tramite il flusso reset-credentials. Pubblicato da KYOS. Lo abbiamo scritto...

CVE-2026-19685

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

Malicious code in dims-hydration-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a85d660f6cc363a81624c7383318958bb46f2d6958fdad71e595692420d805d On any import 'dims-hydration-ui', index.mjs chmods 0755 and spawns a bundled Linux x8664 ELF at dist/internal/calc.dat as a detached child, describe...

CVE-2026-71366 Awx: notification backends allow ssrf and credential leakage

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

EUVD-2026-64923

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

CVE-2026-71366

A server-side request forgery (SSRF) vulnerability affects multiple AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) in Red Hat Ansible Automation Platform 2.5 and 2.6 . Notification template URLs are used as direct HTTP request targets without validating against private,...

CVE-2026-71366

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

CVE-2026-68508

A flaw was found in Hydra. The hydra.utils.instantiate function, used for configuring complex applications, can be exploited by passing untrusted configuration. This allows an attacker to control target values and arguments, leading to the execution of arbitrary code within the application's...

TP-Link-defaults

TP-Link-defaults Script Python per provare password predefinite per alcuni hotspot TP-Link Ispirato da Utilizzo root@kitploit: usage: scan.py -h -p -t TIMEOUT Python script for trying default passwords for some TP-Link Hotspots optional arguments: -h, --help show this help message and exit -p,...

CVE-2026-78386

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private. These...

CVE-2026-21751

HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal component is breached...

CVE-2026-21755 HCL Hive is affected by a missing rate limit

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

CVE-2026-21755

HCL Hive is affected by a missing rate limit that could allow an attacker to achieve unauthorized access via brute-force or credential stuffing attacks, or cause a denion of service . The CVSS 3.1 base score is 5.3 (MEDIUM) with a network attack vector, low complexity, and no privileges required....

EUVD-2026-64893

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

OracleOTM

OracleOTM Strumento Python per sfruttare CVE-2021-35616 Lo script funziona a moduli, che ho implementato nel seguente ordine: ► Enumerazione degli username ► Ricerca di credenziali predefinite ► Esecuzione di una query SQL tramite il servlet DBXML ► Sfruttamento completo ed esecuzione di JSP La...

vulnerability-assessment

Valutazione delle vulnerabilità di OpenSSH Valutazione professionale della sicurezza informatica che dimostra l'identificazione delle vulnerabilità, il punteggio di gravità CVSS, l'applicazione del framework MITRE ATT&CK e la pianificazione dettagliata della correzione per le vulnerabilità critic...