EUVD-2026-77542

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools.validateurl calls hostisblocked, which checks literal host encodings but does not resolve DNS names before scrapepage, crawl, extractlinks, extracttext, or URL-mention fetches connect. An attacker-controlled...

CVE-2026-57126

PraisonAI 's multi-agent system (packages praisonaiagents ≤ 1.6.39 / PraisonAI ≤ 4.6.39) is affected by a CWE-918 SSRF in SpiderTools._validate_url (praisonaiagents/tools/spider_tools.py). The guard (_host_is_blocked) checks only literal IP encodings and never resolves DNS names , so an attacker-...

CVE-2026-57120 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, executecode sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.formatmap to resolve dotted fields through C-level attribute access that bypasses safegetattr. This exposes class,...

keepass_poc

CVE-2022-0725 PoC para KeePass CVE-2022-0725 Pasos para Reproducir: Paso 1: Ejecuta "journalctl -f" en una ventana de terminal. Paso 2: Haz doble clic en una contraseña en KeePass. Paso 3: Espera a que se active el tiempo de espera de borrado. Resultados reales: Ver tu contraseña en texto plano...

CVE-2020-13937

Descripción Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha tiene una API REST que expone la información de configuración de...

EUVD-2026-77524

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...

CVE-2026-82433

Apache Storm Nimbus and UI components are affected by a credential disclosure vulnerability. The getNimbusConf function returned the full daemon configuration without masking sensitive values after only a user-level authorization check. The UI endpoint /api/v1/cluster/configuration compounded the...

EUVD-2026-77521

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

CVE-2026-82434 Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

EUVD-2026-77516

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

CVE-2026-82437

Apache Storm Logviewer fails to enforce its configured logs.users and logs.groups access controls for daemon logs . The root cause is twofold: the access-decision logic discarded the authorizer's result whenever the "daemon log" flag was set, and the daemon log page and download endpoints reached...

EUVD-2026-77515

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

EUVD-2026-77482

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

CVE-2026-84179 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

CVE-2026-84179

Apache Storm (Nimbus component and Storm UI) is affected by an information disclosure vulnerability in getTopologyPageInfo, which merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field. The Storm UI copied ...

CVE-2017-8225-EXPLOIT

CVE-2017-8225 - Fuga de System.ini de GoAhead Esta vulnerabilidad afecta a dispositivos de cámara IP inalámbrica P2P WIFICAM. Surge de una falla al validar correctamente los archivos .ini, que almacenan credenciales críticas. Un atacante habilidoso puede explotar esto proporcionando valores vacío...

CVE-2017-14262

SamsungNVRvul CVE-2017-14262 xfuturesec Co., Ltd First, get the MD5 hash password of the 'admin' account. Send: GET http://192.168.1.14/cgi-bin/main-cgi?json="cmd":201,"szUserNameQry":"admin","szUserName":"","u32UserLoginHandle":0 HTTP/1.1 Host: 192.168.1.14 User-Agent: Mozilla/5.0 Windows NT 6.3...

CVE-2018-9995-EXPLOIT

CVE-2018-9995 - Bypass de Autenticación en DVR Este repositorio aborda la vulnerabilidad de seguridad identificada como CVE-2018-9995, que afecta a varios dispositivos DVR, incluyendo TBK DVR4104, DVR4216, Novo, CeNova, QSee, Pulnix, XVR 5 en 1, Securus, Night OWL, DVR Login, HVR Login y MDVR...

CVE-2026-77883

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's if...