CVE-2026-100252

Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity authzid that a client requests, without checking it against the principal the client authenticated as. The serve...

PT-2026-136922

Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity authzid that a client requests, without checking it against the principal the client authenticated as. The serve...

CVE-2026-109142

The Krill server is vulnerable to an authorization bypass when a Certificate Authority (CA) and its parent reside on the same server. Instead of verifying a signed CMS message, the system executes the RFC 6492 provisioning exchange in-process and trusts the child_handle provided by the caller in ...

CVE-2026-109142 Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...

CVE-2026-109142 Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...

CVE-2026-55040

Microsoft SharePoint JWT Authentication Bypass CVE-2026-55040 Overview CVE-2026-55040.py is a proof-of-concept script to leverage the SharePoint authentication bypass vulnerability, CVE-2026-55040. For a full technical analysis, see our Rapid7 Analysis. Usage $ python CVE-2026-55040.py --help...

openSUSE 16: bouncycastle / bouncycastle-javadoc / bouncycastle-jmail / etc (openSUSE-SU-2026:22169-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22169-1 advisory. Update to 1.86: - CVE-2026-17507: negative signed leafindex values from unsigned wire encodings can cause heap exhaustion bsc1284075. -...

CVE-2024-0044

CVE-2024-0044- CVE-2024-0044: a "run-as any app" high-severity vulnerability affecting Android versions 12 and 13 CVE-2024-0044 Exploit Script This Bash script demonstrates how to exploit CVE-2024-0044. For educational and testing purposes only. Prerequisites ADB Android Debug Bridge installed an...

cve-2025-24054-lab

CVE-2025-24054 — Detection & Mitigation Lab Project log for a defensive security lab on CVE-2025-24054 , the Windows New Technology LAN Manager NTLM Hash Disclosure Spoofing vulnerability, under the assumption that the affected system cannot be patched short-term. Blue-team educational project...

CVE-2026-115962

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...

CVE-2026-115962

The myCred WordPress plugin (versions through 4.0.1 ) is vulnerable to an Authentication Bypass by Spoofing vulnerability. This flaw allows for Identity Spoofing , where an attacker may bypass authentication mechanisms. While the vulnerability is identified as CWE-290 , the provided documents do ...

CVE-2026-115962 WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...

CVE-2026-115962 WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...

EUVD-2026-112736

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...

WordPress myCred authorization issue vulnerability

WordPress myCred versions 4.0.1 and earlier contain an authorization issue vulnerability. This vulnerability stems from an authentication bypass caused by identity spoofing, which may lead to identity spoofing...

PT-2026-132083

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...

CVE-2026-115962: myCred: Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects…

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1...

Electron: Pointer lock permission requests can be attributed to the wrong frame

Impact For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedd...

CVE-2026-110853

n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to...

CVE-2026-110853

The n8n automation platform, in versions prior to 1.123.83 , is susceptible to an authorization bypass vulnerability (CWE-639). Authenticated members can spoof workflow identities by providing a trusted identifier when using Execute Sub-workflow in inline JSON mode. This flaw allows attackers to ...