CVE-2026-8181

CVE-2026-8181 개념 증명 연구 • 검증 • 보안 테스트 "장미는 빨갛고, 제비꽃은 파래요, 너를 생각하다가 바지에 지렸어요. rizz" CVE 개요 필드| 값 ---|--- CVE ID| CVE-2026-8181 유형| Authentication Bypass 영향| Privilege Escalation / Full Site Takeover 공격 경로| Network Remote, Unauthenticated CVSS| 9.8 Critical 영향받는 소프트웨어| Burst Statistics –...

CVE-2026-74865

sogoyhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's accoun...

CVE-2026-74865

The sogo_yhn component contains an authentication bypass vulnerability caused by the configuration parameter SOGoTrustProxyAuthentication=YES. This configuration allows an unauthenticated attacker to bypass password requirements during HTTP Basic authentication by providing a valid username and a...

CVE-2026-74865 Authentication Bypass in sogo_yhn

sogoyhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's accoun...

EUVD-2026-89797

sogoyhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's accoun...

CVE-2026-74865 Authentication Bypass in sogo_yhn

sogoyhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's accoun...

CVE-2026-92751: Cross-Site Request Forgery (CSRF)

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...

EUVD-2026-68038

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-73046: Improper Restriction of Excessive Authentication Attempts

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code Conf.AccessAuthCode as the Basic Auth password but never consults the...

CVE-2026-68503: Use of Default Credentials

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payloadschema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachabl...

CVE-2026-28699: Improper Access Control

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication...

CVE-2026-45690: Improper Authentication

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication 2FA protections...

CVE-2026-31882

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication DAGUAUTHMODE=basic, all Server-Sent Events SSE endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG...

CVE-2026-31882: Missing Authentication for Critical Function

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication DAGUAUTHMODE=basic, all Server-Sent Events SSE endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG...

Debian dla-4494 : liborthancframework-dev - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4494 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4494-1 [email protected] https://www.debian.org/lts/security/...

CVE-2026-24455

The embedded web interface of the device does not support HTTPS/TLS for authentication and uses HTTP Basic Authentication. Traffic is encoded but not encrypted, exposing user credentials to passive interception by attackers on the same network...

CVE-2026-24455: Cleartext Transmission of Sensitive Information

The embedded web interface of the device does not support HTTPS/TLS for authentication and uses HTTP Basic Authentication. Traffic is encoded but not encrypted, exposing user credentials to passive interception by attackers on the same network...

CVE-2025-15581

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access...

CVE-2025-15581: Improper Authentication

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access...

CVE-2019-11367

An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password in the WWW-Authenticate attribute. By using this account and password, anyone can login successfully...