cve-2018-11714_POC

cve-2018-11714POC Se descubrió un problema en TP-Link TL-WR840N. Este problema es causado por un manejo inadecuado de sesiones en la carpeta /cgi/ o en un archivo /cgi. Si un atacante envía un encabezado de "Referer: http://192.168.0.1/mainFrame.htm" no se requiere autenticación para ninguna...

CVE-2026-105161 invariant-systems-ai aiir Policy Gate signature verification

A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade...

CVE-2026-105161 invariant-systems-ai aiir Policy Gate signature verification

A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade...

EUVD-2026-92118

A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade...

Exploit for Improper Validation of Consistency within Input in Linux Linux_Kernel

copyfail-check !CIhttps://github.com/ledlight33/copyfail-...

CVE-2021-24762

Overview This repository documents the detection of CVE-2021-24762, a vulnerability identified on a WordPress instance through HTTP scanning. The vulnerability was discovered on the WordPress AJAX endpoint: /wp-admin/admin-ajax.php This endpoint is commonly used by WordPress plugins and themes to...

cve-2019-14326

CVEID : CVE-2019-14326 Nombre del productos afectados y versiónes : Andy todas las versiones hasta 46.11.113 Tipo de problema : CWE-284: Control de Acceso Inadecuado Resumen Andy es un emulador de Android para Windows y Mac. Durante nuestras pruebas, hemos encontrado puertos TCP locales abiertos...

CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass

CVE-2025-46018 – Omisión de Autenticación de Pago en la Aplicación Móvil CSC Pay Resumen Se descubrió una vulnerabilidad de omisión de autenticación de pago en la aplicación móvil CSC Pay, que afecta a la versión 2.19.4. El fallo permitía a un atacante iniciar un pago, deshabilitar Bluetooth en u...

CVE-2021-3754

CVE-2021-3754 Este repositorio documenta los detalles de vulnerabilidad y el exploit para CVE-2021-3754 descubierto y reportado por mí mismo el 21 de agosto de 2021 Métricas CWE-20: Validación de entrada incorrecta CVSS: 5.3 MEDIUM Descripción Se encontró una falla en Apache Keycloak y Redhat SSO...

SealSecurityAssignment

SealSecurityAssignment Investigando la vulnerabilidad CVE-2023-26136 Investigación sobre Vulnerabilidad: CVE-2023-26136 Descripción: Las versiones del paquete tough-cookie anteriores a la 4.1.3 son vulnerables a Prototype Pollution debido al manejo inadecuado de cookies al usar CookieJar en modo...

CVE-2026-105209

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...

CVE-2022-24087

CVE-2022-24086-RCE y CVE-2022-24087-RCE Descripción de CVE CVE-2022-24086 y CVE-2022-24087 - vulnerabilidad de validación de entrada incorrecta en el formulario de contacto de Magento Open Source y Adobe Commerce - ha recibido una puntuación CVSS de 9.8 sobre 10, se clasifica como un problema de...

CVE-2026-105209 ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...

CVE-2026-105209 ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...

CVE-2026-105209

ZITADEL versions 3.x before 3.4.15 and 4.x before 4.17.1 are vulnerable to an improper authorization flaw (CWE-862) during passkey or passwordless enrollment. The system incorrectly validates the organization ID provided in the x-zitadel-orgid header instead of verifying the target user's actual ...

EUVD-2026-92102

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...

CVE-2026-105209 ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...

CVE-2024-52318

CVE-2024-52318 🚨🚨CVE-2024-52318 - Vulnerabilidad XSS en Apache Tomcat en JSPs generados🚨🚨 Descripción general CVE-2024-52318 es una vulnerabilidad de Cross-Site Scripting XSS en Apache Tomcat, que surge de la liberación inadecuada de recursos en JavaServer Pages JSPs generados. Este problema,...

cve-2022-44268

CVE-2022-44268 ImageMagick es un paquete de software multiplataforma gratuito y de código abierto para visualizar, convertir y editar imágenes rasterizadas y vectoriales. Puede leer y escribir más de 200 formatos de archivo de imagen. ImageMagick está bajo la licencia Apache 2.0. Está disponible...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-88779link is external Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This type of vulnerability is a...