CVE-2025-54253-Exploit-Demo

🚨 CVE-2025-54253 – Injection OGNL vers RCE sur Adobe AEM Forms on JEE 🔎 Vue d'ensemble CVE-2025-54253 est une vulnérabilité critique d'injection OGNL affectant Adobe AEM Forms on JEE. Elle permet à des attaquants non authentifiés d'exécuter des commandes système arbitraires via le point de...

CVE-2025-34171

CVE-2025-34171: Неавторизованный доступ к файлам и отладочным данным в CasaOS Обзор уязвимости Поле| Значение ---|--- CVE ID| CVE-2025-34171 Затрагивает| CasaOS ≤ 0.4.15 Исправлено в| Нет доступного исправления Серьезность| Средняя CVSS 4.0|...

CVE-2023-42793-TeamCity-Unauthenticated-RCE

CVE-2023-42793 — Инструмент оценки безопасности JetBrains TeamCity Этот репозиторий содержит утилиту на Python, предназначенную для оценки и демонстрации последствий уязвимости CVE-2023-42793 — критической уязвимости, затрагивающей локальные серверы JetBrains TeamCity. Сведения об уязвимости...

CVE-2026-23744-POC

Описание Эта уязвимость существует, потому что MCPJam Inspector открывает внутренние конечные точки API, предназначенные для отладки и разработки. Эти конечные точки принимают вводимые пользователем данные и передают их напрямую в выполнение системных процессов без надлежащей проверки или очистки...

CVE-2026-93685

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...

EUVD-2026-82981

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...

CVE-2026-93685 Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...

CVE-2026-93685

A misconfiguration in the addon-framework library's cmdfactory.newcontrollercommandconfig exposes an unauthenticated debug endpoint on the multicluster-observability-addon component. After completing a basic encrypted connection, a remote attacker on an adjacent network can retrieve sensitive ope...

CVE-2026-93685

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...

CVE-2026-93685: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...

PT-2026-95430

Name of the Vulnerable Software and Affected Versions multicluster-observability-addon affected versions not specified Description A misconfiguration in the underlying addon-framework library allows a remote attacker to access a debug endpoint without authentication. After establishing a basic...

GO-2026-6356 Missing authorization on vttablet /debug/vrlog in vitess.io/vitess

The vttablet /debug/vrlog HTTP endpoint streams live VReplication event data, including SQL statements and table row changes, without verifying authorization via acl.CheckAccessHTTP. An unauthenticated actor with network access to the debug endpoint can stream live replicated SQL data...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity

CVE-2023-42793 - JetBrains TeamCity Security Assessment Tool...

UBUNTU-CVE-2026-79776

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials...

SUSE CVE-2026-65959

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Vulnerability Details File: go/vt/vttablet/tabletmanager/vreplication/vrlog.go Summary vttablet's /debug/vrlog HTTP endpoint streams live VReplication event data — including the literal SQL DML statements being replicated by MoveTables, Reshard, Materialize, and "vitess"-strategy Online DDL...

AZL-96770 CVE-2026-65959 affecting package vitess for versions less than 19.0.4-13

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

CVE-2026-65959

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

CVE-2026-65959

In Vitess 24.0.2 and earlier, the /debug/vrlog endpoint in vrlog.go calls vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote attacker reaching the vttablet debug HTTP port can stream live VReplication SQL statements and bound application...

CVE-2026-65959 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...