CVE-2026-63329

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to version 0.25.6 , the copy_server_request function in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before the authenticated username is injected via inject_own_headers. Be...

CVE-2026-63329 Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

CVE-2024-0044

CVE-2024-0044- CVE-2024-0044: Android 12 및 13에 영향을 미치는 '모든 앱으로 실행' 고심각도 취약점 CVE-2024-0044 익스플로잇 스크립트 이 Bash 스크립트는 CVE-2024-0044를 익스플로잇하는 방법을 보여줍니다. 교육 및 테스트 목적으로만 사용하세요. 사전 요구 사항 ADB Android Debug Bridge 설치 및 구성됨 USB 디버깅이 활성화된 연결된 Android 기기 스크립트 코드 root@kitploit: !/bin/bash Function to exploit...

CVE-2026-55040

Microsoft SharePoint JWT 認証バイパス CVE-2026-55040 概要 CVE-2026-55040.py は、SharePoint の認証バイパス脆弱性 CVE-2026-55040 を悪用するための概念実証 PoC スクリプトです。 詳細な技術分析については、当社の Rapid7 Analysis を参照してください。 使用方法 root@kitploit: $ python CVE-2026-55040.py --help usage: CVE-2026-55040.py -h --target TARGET --host HOST --x5t X5T...

CVE-2026-78296

Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects FluentAuth: from n/a through 2.1.2...

CVE-2026-78296 WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability

Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects FluentAuth: from n/a through 2.1.2...

CVE-2026-78296

CVE-2026-78296 affects WP ManageNinja LLC's FluentAuth WordPress plugin (versions up to 2.1.2 ). The vulnerability is classified as Insufficient Verification of Data Authenticity , which allows Identity Spoofing through the plugin's email verification mechanism. The CVSS 3.1 score is 5.3 (MEDIUM)...

GO-2026-6455 Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik

Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik...

cve-2025-24054-lab

CVE-2025-24054 — 탐지 및 완화 실습실 CVE-2025-24054 에 대한 방어 보안 실습실의 프로젝트 로그입니다. 이는 Windows NT LAN 관리자NTLM 해시 노출 스푸핑 취약점으로, 영향을 받는 시스템을 단기간에 패치할 수 없다 는 가정 하에 작성되었습니다. 블루팀 교육 프로젝트머독 대학교 ICT279. 악용 기술은 공개적으로 문서화되어 있으며Check Point, CISA KEV, 원본 기여는 탐지 및 완화 방법론입니다. 이 저장소에는 실제 자격 증명이나 VM 자격 증명 시트가 저장되어 있지 않습니다...

CVE-2026-59157

webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script...

CVE-2026-59157

webhookd is a minimalist webhook server that triggers shell scripts via HTTP requests. Prior to 1.22.0 , deployments without htpasswd authentication forwarded all incoming HTTP headers into the hook script environment via HTTPParamsToShellVars in pkg/api/index.go without an allowlist. If an upstr...

Security Bulletin: Multiple Security Vulnerabilities in IBM WebSpheere Application Server affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-3621 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to...

CVE-2026-90679

A flaw was found in Forgejo when federation is enabled. This issue allows a remote attacker to spoof identities by submitting signature-valid ActivityPub activities attributed to any actor identity. The system fails to verify that the HTTP Signature on an incoming ActivityPub activity was produce...

Security Bulletin: There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Maximo Manage application in IBM Maximo Application Suite

Summary Security Bulletin: There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Maximo Manage application in IBM Maximo Application Suite CVE-2026-3621,CVE-2026-8633,CVE-2026-8620,CVE-2026-10852,CVE-2026-8858,CVE-2026-9072,CVE-2026-11536, CVE-2026-9071 Vulnerability...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4 with [federation] ENABLED = true contains a signature-spoofing flaw in its ActivityPub inbox processing. The HTTP Signature verification in routers/api/v1/activitypub/reqsignature.go validates the request, but inbox handlers then read the acting identity from the att...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

EUVD-2026-76944

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

PT-2026-90787

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

EUVD-2026-76137

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including...

CVE-2026-88879

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. Due to a discrepancy in how Traefik and certain backend applications process HTTP header names, a remote attacker can smuggle specially crafted headers. This allows the attacker to bypass identity assertions made by Traefik,...