CVE-2026-85590

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...

RemoteMonologue

RemoteMonologue RemoteMonologue هي تقنية لجمع بيانات الاعتماد في ويندوز تتيح اختراق المستخدمين عن بُعد عبر استغلال مفتاح Interactive User RunAs وإجبار مصادقات NTLM من خلال DCOM. اقرأ مقال X-Force Red RemoteMonologue: تسليح DCOM لإجبار مصادقات NTLM للحصول على معلومات مفصلة. الميزات 🔹 إجبار المصادق...

CVE-2026-11109-Bluetooth-Classic-KNOB-Attack-Key-Negotiation-of-Bluetooth-

CVE-2026-11109 – هجوم KNOB على البلوتوث الكلاسيكي تفاوض مفتاح البلوتوث كود البرنامج محاكاة Python root@kitploit: knobattacksim.py - Simulates negotiation of encryption key size to 1 byte import random, hashlib class BluetoothDevice: def negotiatekeysizeself, proposedsize: Vulnerable: accepts any...

smugglex

Rust द्वारा संचालित HTTP अनुरोध स्मगलिंग स्कैनर। अवलोकन Smugglex एक सुरक्षा परीक्षण उपकरण है जो वेब अनुप्रयोगों में HTTP अनुरोध स्मगलिंग कमजोरियों का पता लगाता है। यह CL.TE, TE.CL, TE.TE, H2C, और H2 स्मगलिंग हमलों का परीक्षण करता है, और — HTTPS लक्ष्यों पर — वास्तविक HTTP/2 ALPN h2 बोलता है ताकि...

libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

CVE-2026-22002-VNC-Authentication-Bypass-via-Protocol-Version-Confusion

CVE-2026-22002 – प्रोटोकॉल संस्करण भ्रम के माध्यम से VNC प्रमाणीकरण बाईपास प्रोग्राम कोड Python root@kitploit: vncserversim.py - VNC server with version negotiation flaw import socket, struct def handleconn: Send server version "RFB 003.008\n" conn.sendb"RFB 003.008\n" Receive client version...

GHSA-3F6P-5WW8-9RCR MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

Summary A rogue MySQL server or MITM can force mysql2 to send credentials in plaintext by requesting an auth switch to mysqlclearpassword. The driver complies without verifying that TLS is active. Details mysqlclearpassword is registered as a default standard plugin in lib/commands/authswitch.js...

CVE-2026-71554

A flaw was found in h2, a Python library for HTTP/2. This vulnerability allows a remote attacker to perform request smuggling. The library incorrectly processes HTTP/2 requests that contain more than one Host header. When these requests are downgraded to HTTP/1.1 by a consuming application, the...

CVE-2026-79779

A flaw was found in rclone. The application fails to reject transport downgrades during redirect handling, which allows Basic authorization and Cookie headers to be replayed over plaintext HTTP following HTTPS-to-HTTP redirects on the same host. An on-path attacker can observe this plaintext...

CVE-2026-82463

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks...

CVE-2026-82255

gitoxide versions from 0.25.4 contain an HTTP credential leak in the curl-based transport backend . The root cause is that credential validation checks the original URL rather than the effective URL after a redirect, allowing credentials to be sent to attacker-controlled destinations via cross-do...

CVE-2026-82245 Budibase before 3.41.3 Missing Authorization License Management

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/ endpoints to disable premium features and...

CVE-2026-59293

Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5....

EUVD-2026-67181

Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5....

CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1

Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5....

CVE-2026-59293

Spring Integration versions 6.4.0–6.4.12, 6.5.0–6.5.10, and 7.0.0–7.0.5 are affected by a vulnerability in the underlying jCIFS client . Unless an application explicitly raises smbMinVersion, the client will negotiate down to SMB1/CIFS , which lacks mandatory signing and encryption, exposing it t...

CVE-2026-81697

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

CVE-2026-81697

The openssl-encrypt PyPI package (versions ≤ 1.4.8) contains a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE—originally set to the absolute per-user path ~/.crypt_settings.json—is reassigned at line 84 to the bare relative name crypt_settings.json. The le...

CVE-2026-81697 openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...