CVE-2026-34486

CVE-2026-34486 Apache Tomcat Tribes 集群中 EncryptInterceptor 存在 fail-open 绕过漏洞，导致通过 Java 反序列化实现未授权远程代码执行（RCE）。 受影响版本：11.0.19+、10.1.53+、9.0.116+。 修复版本：11.0.21、10.1.54、9.0.117。 由 Bartlomiej Dmitruk striga.ai 发现并报告。 技术文章：https://striga.ai/research/tomcat-tribes-unauth-rce 需求 Docker Java 21 Python 3 使用...

ams-failopen

Firma Fail-Open en AppleMediaServices Divulgación de Zero-Day Resumen Este problema constituye una vulnerabilidad Zero-Day activa y refleja un defecto de diseño sistémico en AppleMediaServices.framework, más que una regresión o un error específico de una versión. Una falla crítica de tipo fail-op...

Dolibarr <=22.0.4 - Local File Inclusion

Dolibarr = 22.0.4 contains a local file inclusion caused by manipulation of the objectdesc parameter and a fail-open logic flaw in restrictedArea in /core/ajax/selectobject.php, letting authenticated users with no specific privileges read arbitrary non-PHP files. id: CVE-2026-34036 info: name:...

EUVD-2026-82912

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

CVE-2026-93593

ArcadeDB before 26.9.1 is affected by a TimeSeries ACL bypass (CVE-2026-93593). The root cause lies in the ACL resolver, which builds permissions from bucket IDs; however, TimeSeries types do not own normal record buckets, causing the missing type-name-based access check and resulting in permissi...

CVE-2026-90978 Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin...

CVE-2026-90978

The Filter Gallery WordPress plugin before version 1.1.5 is vulnerable due to a fail-open nonce check on several of its AJAX handlers: when the nonce field is omitted, verification passes, and no additional capability check is applied. This allows low-privileged users (Subscriber and above) to ov...

POC-CVE-2026-1357

CVE-2026-1357 WPvivid Backup & Migration RCE PoC 发现者： Lucas Montes NiRoX 漏洞类型： 未认证任意文件上传导致远程代码执行（RCE） CVE ID： CVE-2026-1357 CVSS 评分： 严重（9.8） 状态： 已在 0.9.124 版本中修复 概述 本仓库包含对 WPvivid Backup & Migration WordPress 插件（版本 = 0.9.123）中一个严重漏洞的分析和概念验证（PoC）。 该漏洞允许未认证攻击者 向服务器上传任意文件（如 PHP 木马），从而立即实现远程代码执行（RCE）...

CVE-2026-61595

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

EUVD-2026-80851

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

CVE-2026-61595 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

CVE-2026-1357-POC

CVE-2026-1357 — WPvivid Backup & Migration RCE CVE 致谢： Lucas Montes NiRoX 工具作者： CyberTechAjju CVSS： 9.8（严重） | 受影响版本： ≤ 0.9.123 | 已修复版本： 0.9.124 ⚠️ 免责声明 仅用于授权安全测试 。未经授权访问系统属于违法行为。 概述 通过两个链式漏洞在 WPvivid Backup & Migration 中实现未认证 RCE： 1. 加密失败开放（Crypto Fail-Open） — opensslprivatedecrypt 在密钥错误时返回 false ...

CVE-2026-53913

CVE-2026-53913 — camel-keycloak 故障开放（Fail-Open）身份验证绕过 针对同一 Apache Camel 漏洞的可运行概念验证（PoC）复现程序，每种运行时一个： 运行时| 目录| 技术栈 ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Camel Quarkus 3.36.0（集成了 Camel 4.20.0 ）...

CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

CVE-2026-34486 Apache Tomcat Tribes 集群中 EncryptInterceptor 的 fail-open 绕过，导致通过 Java 反序列化实现未授权远程代码执行（RCE）。 受影响版本：11.0.19+、10.1.53+、9.0.116+。 修复版本：11.0.21、10.1.54、9.0.117。 发现并报告者：Bartlomiej Dmitruk（striga.ai）。 技术分析：https://striga.ai/research/tomcat-tribes-unauth-rce 环境要求 Docker Java 21 Python 3 用法...

CVE-2026-86259

CVE-2026-86259 - OpenMAIC 1.0.0：通过 Fail-Open 中间件与环境门控验证绕过实现未认证出站 SSRF 至云元数据服务 概述 已验证。OpenMAIC 的认证中间件与出站提供商请求层中存在一条两段式利用链，允许未认证的远程攻击者使应用服务器发起任意出站 HTTP 请求——包括访问位于 169.254.169.254 的云实例元数据服务（IMDS）——而无需持有任何凭据。 第一段： middleware.ts 中的 Next.js Edge 中间件在 ACCESSCODE 环境变量缺失时采用 fail-open 姿态。在默认的 .env.example...

CVE-2026-53459

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database...

CVE-2026-70376

CVE-2026-70376 — Pluck CMS 全站 CSRF → RCE 宽松模式（fail-open）的 Referer 校验 + 无 CSRF 令牌 + 双扩展名上传 管理员仅需访问一次页面，即可删除内容、注入页面并植入 WebShell 概览 · 摘要 · 根因 · 攻击链 · 利用 · 修复建议 · 时间线 📋 概览 🔎 摘要 Pluck 管理后台在整个代码库中没有任何基于请求的 CSRF 令牌 。每个改变状态的管理操作都由同一个函数把关，即 requestedByTheSameDomain，它唯一的防御是 Referer 主机名比对...

CVE-2026-53459 Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database...

CVE-2026-53459

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. A fail-open flaw in the authentication code (introduced in version 0.1.6, fixed in 0.2.4.4) allows an unauthenticated, remote attacker to flood a public endpoint, exhausting resources until database access fa...

DEBIAN-CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...