73 matches found
hyperswitch-unsigned-webhook
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · hyperswitch-unsigned-webhook Write-up: https://abraxaslabs.tech/research/hyperswitch-unsigned-webhook hyperswitch-unsigned-webhook Hyperswitch 2026.09.21.0 - Juspay Worldpayxml::verifywebhooksource returns Oktrue with...
vsftpd-ssl-data-any-ticket
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vsftpd-ssl-data-any-ticket Write-up: https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket vsftpd-ssl-data-any-ticket Class: Privilege leftover Reach: Remote vsftpd 3.0.5 Chris Evans - official tarball SHA-256...
lago-stripe-invoice-idor
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · lago-stripe-invoice-idor Write-up: https://abraxaslabs.tech/research/lago-stripe-invoice-idor lago-stripe-invoice-idor Lago v1.53.0 - GetLago POST /webhooks/stripe/:organizationid verifies Stripe-Signature with that...
New API < v0.12.10 - Stripe Webhook Bypass
New API v0.12.10 contains a broken authentication caused by unauthenticated attacker forging Stripe webhook events, letting attackers credit arbitrary quota without payment, exploit requires no authentication. id: CVE-2026-41432 info: name: New API v0.12.10 - Stripe Webhook Bypass author: str4k3r...
ProSoft RLX-IFH24E v2.2.44 - Firmware Upgrade Package Executed Without Any Integ — Detect
Fingerprint / reachability check for ProSoft RLX-IFH24E v2.2.44 - Firmware Upgrade Package Executed Without Any Integrity Check, Reaching Root Command Execution and Full Overwrite of the Account Database CWE-494, CWE-345 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for ProSoft RLX-IFH24...
Security Bulletin: IBM Test Accelerator for Z uses sdk-1.26.0.tgz which is vulnerable to CVE-2026-104850
Summary IBM Test Accelerator for Z uses sdk-1.26.0.tgz which is vulnerable to CVE-2026-104850. This security bulletin provides details about the vulnerability and the corresponding remediation. Vulnerability Details CVEID:CVE-2026-104850 DESCRIPTION: MCP TypeScript SDK is the official TypeScript...
Security Bulletin: z Open Editor and RSE CLI uses sdk-1.30.0.tgz which is vulnerable to CVE-2026-104850
Summary Security Bulletin: z Open Editor and RSE CLI uses sdk-1.30.0.tgz which is vulnerable to CVE-2026-104850 Vulnerability Details CVEID:CVE-2026-104850 DESCRIPTION: MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and...
CVE-2026-102250
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the affected software. This flaw could allow an attacker to upload modified firmware when an authorized administrator initiates a firmware update procedure. Successful exploitation could result in an attacker gainin...
Security Bulletin: Vault PKI ACME Issues Certificate With Unvalidated SANs
Summary Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabli...
CVE-2026-59357
Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...
CVE-2026-59357 Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions
Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...
CVE-2026-73177: Insufficient Verification of Data Authenticity
Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without...
Exploit for CVE-2026-9090
CVE-2026-9090 — Casdoor SAML Signature Bypass PoC Proof-of-...
Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in dnsjava (CVE-2024-25638)
Summary A vulnerability in dnsjava that is used by InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2024-25638 DESCRIPTION: dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to...
CVE-2020-7487
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M241, M251, and M258 controllers...
EUVD-2020-28612
Malware in sbrugna...
EUVD-2023-31705
Malicious code in bioql PyPI...
EUVD-2022-35030
Malicious code in bioql PyPI...