CVE-2026-96512

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-96512 CVE-2026-96512 sudo 1.9.13p3 Debian bookworm - Sudo Project I am @abraxasnull. Local lab, not HTTP. The client is CVE-2026-96512-Abraxas-Labs.py. NOTBEFORE / NOTAFTER timestamps without a trailing Z go...

Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch

Nexus Repository 3 CE/Pro 3.0.0 through 3.94.x contains an incorrect authorization vulnerability caused by inconsistent authorization checks in the repository-creation UI, letting delegated repository-admin users create unauthorized repository formats, exploit requires delegated repository-admin...

Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration

Parse Server 8.6.21 / 9.x 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a...

CVE-2022-0482_exploit

Exploitation de la vulnérabilité CVE-2022-0482 Introduction Ce document présente l'analyse détaillée de CVE-2022-0482, une vulnérabilité de sécurité critique identifiée dans le logiciel de planification Easy!Appointments. Cette faille, liée à une autorisation incorrecte CWE-863, permet un accès n...

CVE-2026-54998-exp

إخلاء مسؤولية هذا المستودع مخصص للأغراض التعليمية والبحثية فقط. المؤلف غير مسؤول عن أي سوء استخدام أو ضرر أو أنشطة غير قانونية ناتجة عن استخدام هذه المواد. استخدم على مسؤوليتك الخاصة. احترم القوانين المعمول بها والمبادئ التوجيهية الأخلاقية. نظرة عامة CVE-2026-54998 هي ثغرة تفويض غير صحيح CWE-863 ...

gitea-CVE-2026-28699

CVE-2026-28699: تجاوز نطاق OAuth2 في Gitea عبر المصادقة الأساسية HTTP يمكن لرمز وصول OAuth2 في Gitea مقتصر على read:user فقط تنفيذ إجراءات كتابة كاملة عند إرساله كـ Authorization: Basic base64:x-oauth-basic بدلاً من كرمز Bearer. يتم تخطي فحص النطاق لأي رمز يتم تقديمه عبر المصادقة الأساسية. المتأث...

opencart-reward-free-checkout

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opencart-reward-free-checkout opencart-reward-free-checkout OpenCart 4.1.0.4 - OpenCart Ltd CVE-2025-15116 était une course de coupons jusqu'à la version 4.1.0.3. Sur la 4.1.0.4, coupon.save supprime paymentmethod...

Adobe Commerce/Magento - Customer Session Identity Switch

Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction. id: CVE-2026-71362 info: name: Adobe Commerce/Magento - Customer Session Identity Switch...

Exploit for CVE-2026-96512

abraxaslabs.tech · github.com/abraxas ·&...

Security Bulletin: Security Vulnerabilities in Third-Party Node.js Packages Used by IBM Rhapsody Systems Engineering

Summary Security vulnerabilities were identified in the product's Node.js dependencies. The issue has been mitigated by removing the vulnerable packages and updating dependencies to secure versions. Vulnerability Details CVEID:CVE-2026-29087 DESCRIPTION: @hono/node-server allows running the Hono...

Exploit for CVE-2026-96512

SudoTimeWarp — CVE-2026-96512 sudo: the caller's TZ decid...

CVE-2026-75745 Adobe Experience Manager Forms JEE | Incorrect Authorization (CWE-863)

Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-75723 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

Adobe Campaign Classic ACC is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-75728 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

Adobe Campaign Classic ACC is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-75728 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

Adobe Campaign Classic ACC is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

BIT-KIBANA-2026-82302 Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

BIT-ELK-2026-82302 Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

BIT-ELK-2026-82299 Incorrect Authorization in Kibana Leading to Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

BIT-ELK-2026-82298 Incorrect Authorization in Kibana Leading to Denial of Service

Incorrect Authorization CWE-863 in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

CVE-2026-81997

Acrobat Reader is affected by an Incorrect Authorization vulnerability (CWE-863) that can result in a security feature bypass , allowing an attacker to gain unauthorized write access . Exploitation requires user interaction — a victim must open a malicious file — and the attack vector is local wi...