agentZ

AgentZ Piattaforma Agentica AI Zero Trust Costruisci, esegui e governa agenti AI. Sicura by design. Ogni agente viene eseguito all'interno di una sandbox con negazione predefinita e non riceve mai una credenziale. Ogni azione dell'agente è tracciabile. AgentZ è una piattaforma multi-tenant per...

CVE-2024-41290

CVE-2024-41290 FlatPress CMS v1.3.1 1.3 wurde festgestellt, dass es unsichere Methoden zur Speicherung von Authentifizierungsdaten verwendet. Zusätzliche Informationen: FlatPress CMS Version 1.3.1 speichert authentifizierungsbezogene Daten, einschließlich Benutzernamen und gehashter Passwörter,...

CVE-2026-81705

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings e.g. -apHunter2 or abbreviated long-option spellings e.g. --passw. The sanitizer only recognized exact option names, --option=value forms, and...

CVE-2026-81715

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2026-81684

In opensslencrypt pip package openssl-encrypt versions /cmdline for the lifetime of the subprocess. Fixed in 1.4.9...

CVE-2026-81098

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

CVE-2025-25968

CVE-2025-25968: Vulnerabilità di controllo degli accessi improprio in DDSN Interactive cm3 Acora CMS versione 10.1.1 DDSN Interactive cm3 Acora CMS versione 10.1.1 contiene una vulnerabilità di controllo degli accessi improprio. Un utente con privilegi di editor può accedere a informazioni...

CVE-2026-19854

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

CVE-2024-43917

CVE-2024-43917 Dieses Skript demonstriert eine SQL-Injection-Schwachstelle, die im TI WooCommerce Wishlist Plugin für WordPress bis Version 2.8.2 CVE-2024-43917 gefunden wurde. Die Schwachstelle ermöglicht es nicht authentifizierten Benutzern, beliebige SQL-Befehle auf der Datenbank der Website...

CVE-2022-35513

blink1-pass-decrypt ⭐ poc e script semplice progettato per decifrare il ciphertext trovato in /blink/input del server api nelle installazioni blink1control2 versioni =2.2.7. l'exploit - CVE-2022-35513 ❗ l'app blink1control2 utilizza una crittografia debole delle password e un metodo di...

CVE-2026-23744

CVE-2026-23744 CVE-2026-23744 RCE Durante l'analisi di questa vulnerabilità, ho scoperto che MCPJam Inspector esponeva l'endpoint /api/mcp/connect alla rete associandosi a 0.0.0.0. Questo endpoint accetta un oggetto JSON contenente serverConfig, inclusi i campi command e args. L'applicazione avev...

CVE-2025-14847

أداة الكشف عن ثغرة MongoDB CVE-2025-14847 أداة الكشف عن ثغرة تسرب الذاكرة في MongoDB CVE-2025-14847 ⚠️ تنبيه مهم: هذه الأداة مخصصة فقط لاختبارات الأمان المصرح بها وتقييم الثغرات. الاستخدام غير المصرح به قد يخالف القانون. 📋 المحتويات وصف الثغرة الميزات التثبيت طريقة الاستخدام إعداد بيئة الاختبار...

EUVD-2026-67089

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

CVE-2026-19854

CVE-2026-19854 affects the ClickHouse plugin (Grafana) when it uses the Native protocol (the default) together with PDC or secure SOCKS . The root cause is that the underlying connection library requests TLS but then ignores it, resulting in plaintext communication with ClickHouse. Concretely, us...

CVE-2026-19854 CVE-2026-19854 CVE Record

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

EUVD-2026-67088

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an...

CVE-2026-23813

CVE-2026-23813 — Bypass di pre-autenticazione di AOS-CX Attaccanti remoti non autenticati possono raggiungere l'API REST di gestione di AOS-CX intrufolando un token login attraverso l'espressione regolare troppo permissiva di nginx, esponendo la superficie di configurazione basata su OVSDB inclus...

CVE-2025-30208-31125-31486-32395

Guida allo sfruttamento delle vulnerabilità di Vite CVE-2025-30208/31125/31486/32395 Questo documento riassume i metodi di sfruttamento di quattro vulnerabilità di lettura arbitraria di file nel server di sviluppo di Vite, inclusi esempi per sistemi Linux e Windows. Nota: utilizzare solo in...

Extracting-User-credentials-For-Web-portal-and-WiFi-AP-For-Hathway-Router-CVE-2024-44815-

Estrazione delle credenziali utente per router Hathway tramite SPI flash-CVE-2024-44815 Descrizione della vulnerabilità: Durante la valutazione della sicurezza del firmware del router, è stato osservato che le credenziali di accesso del router, sia del portale web che del punto di accesso Wi-Fi...

CVE-2026-81715 openssl_encrypt before 1.4.9 Credential Exposure via Debug Output

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...