CVE-2026-81908 Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...

CVE-2026-81908 Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...

EUVD-2026-76160

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...

CVE-2026-81908 Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...

h-encore

h-encore h-encore , where h stands for hacks and homebrews, is the second public jailbreak for the PS Vita™ which supports the newest firmwares 3.65, 3.67 and 3.68. It allows you to make kernel- and user-modifications, change the clock speed, install plugins, run homebrews and much more. Write-up...

spark-exploit

Arbitary Code Execution in Unsecured Apache Spark Cluster How to Exploit Follow the below steps: root@kitploit: $ git clone https://github.com/akhld/spark-exploit.git $ cd spark-exploit Remote Code Execution Open exploit.scala, Replace the following code with whatever you want to get executed!...

MISP v2.5.46

MISP - Threat Intelligence Sharing Platform MISP is an open source software solution for collecting, storing, distributing and sharing cyber security indicators and threats about cyber security incidents analysis and malware analysis. MISP is designed by and for incident analysts, security and IC...

obike

Descripción del Protocolo oBike BLE/HTTP Este documento proporciona un análisis de los protocolos de comunicación de oBike a partir de enero de 2018. Los resultados se han presentado en insomni'hack security conference 2019: diapositivas grabación así como en AREA41 security conference 2018:...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 · Honor WIN RT AAK-AN00 Temporary Root Resear...

VertXploit

VertXploit Exploiting HID VertX and EDGE access control systems Summary VertXploit is a tool that can be used to exploit HID VertX and EDGE access control systems. A vulnerability exists within the discoveryd service, which fails to sanitize user data before executing system calls. This allows fo...

arp-dns-spoof

Installationon Debian-based Linux Distribution Install Scapy root@kitploit: % sudo apt-get install tcpdump graphviz imagemagick python-gnuplot python-crypto python-pyx % pip install scapy Install python-NetfilterQueue root@kitploit: % sudo apt-get install build-essential python-dev...

CVE-2026-89260

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

VulnHub-DC1-Writeup

VulnHub-DC1-Writeup "Writeups de laboratorio de pruebas de penetración que documentan cadenas de ataque completas — desde el reconocimiento hasta el root." 🔓 VulnHub — DC-1 Boot-to-Root Writeup Dificultad: Principiante–Intermedio Plataforma: VulnHub Objetivo: Capturar las 4 banderas y lograr un...

Certighost-CVE-2026-54121

Document Type: Detection Use Case Related CVE: CVE-2026-54121 Certighost Author: Youssef Benchater Detection Use Case: Certighost CVE-2026-54121 This document describes the Splunk detection built for CVE-2026-54121. It follows the standard detection use case format so it can sit in a detection...

Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks

Anthropic on Thursday said it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, Z.ai aka Zhipu, and MiniMax. Knowledge distillation by itself is a legitimate training method. It refers to a...

THM-Billing

🛡️ TryHackMe: Billing Linux Privilege Escalation | Web Ex...

CVE-2025-50364_CSRF_ADD_CATEGORY-phpgurukul-CVE

Nombre del proyecto y URL del repositorio: Maid Hiring Management System using PHP and MySQL Tipo de Vulnerabilidad: Falsificación de Solicitud del Lado del Cliente Versiónes Afectadas: v1.0 💣Descripción de la Vulnerabilidad: Existe una vulnerabilidad de Falsificación de Solicitud entre Sitios CS...

ImpactSword

ImpactSword – Red Team Edition ImpactSword is an offensive se...

HTB-Reactor-Linux-Machine-Walkthrough

HTB: Reactor !CAUTION Spoiler warning. This is a full walkthrough including flags. If you want to solve the machine yourself, close this now and come back when you're stuck. Machine Info Field| Details ---|--- Name| Reactor OS| Ubuntu 24.04 LTS Noble Difficulty| Medium CVE| CVE-2025-55182 CVSS 10...

CVE-2026-75430_PowerJob_worker_deployContainer_RCE

Ejecución Remota de Código No Autenticada en PowerJob Worker a través de /worker/deployContainer Carga Arbitraria de JAR 1. Resumen El Worker de PowerJob expone el manejador deployContainer en su puerto de transporte HTTP 27777 sin autenticación alguna. Un atacante envía una URL arbitraria; el...