CVE-2026-80192 better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

CVE-2026-41707

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-16645

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0...

CVE-2026-16639

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0...

CVE-2026-52776 Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

CVE-2026-52776 Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

CVE-2026-52776 Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

CVE-2026-52776

compliance-trestle (Trestle), a Python tooling platform for managing compliance-as-code via OSCAL, contains an SSRF bypass in its URLSecurityValidator (trestle/core/remote/security.py). The validator fails to canonicalize IPv4-mapped IPv6 literals (e.g., [::ffff:169.254.169.254]) before network m...

keycloak__keycloak_CVE-2022-3782_20-0-1

Keycloak Keycloak è una soluzione Open Source di Identity and Access Management per applicazioni e servizi moderni. Questo repository contiene il codice sorgente per il server Keycloak, gli adattatori Java e l'adattatore JavaScript. Aiuto e documentazione Documentazione Mailing list utenti -...

weakpass

Weakpass Qui puoi trovare l'elenco degli strumenti e un esempio di server API da weakpass.com per il cracking di password e hash in un unico posto. 📂 Struttura delle cartelle tools Una collezione di strumenti per il cracking di password e hash. Dai un'occhiata: Kraker-js Lookup Passcheck Passgen...

CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-41707

Spring Security 's DPoPProofJwtDecoderFactory is vulnerable to a cache-based replay attack . The internal cache that stores JWT ID claims has a strict size limit, which an attacker can exploit by flooding the server with dummy requests to evict legitimate entries, then replaying intercepted valid...

CVE-2025-70545

Router PPC Belden ONT 2K05X Autore: Jeyabalaji Codice prodotto interessato: Router PPC 2K05X - V1.1.9206L Testato su: Windows 11 CVE: CVE-2025-70545 Descrizione: Esiste una vulnerabilità di cross-site scripting XSS persistente nell'interfaccia di gestione web del router PPC Belden ONT 2K05X con...

Gemini-api-key-hunter

Toolkit per chiavi API Gemini Un toolkit per scoprire, validare e testare chiavi API Google Gemini esposte. È composto da due componenti: Gemisc.py – Uno scanner Python ad alta velocità che scopre chiavi API Google esposte da siti web e file JavaScript, le verifica tramite l'API Gemini e identifi...

CVE-2020-14882

Script di test per WebLogic CVE-2020-14882 / CVE-2020-14883 Questo progetto fornisce un semplice script Bash per testare se un server Oracle WebLogic è vulnerabile al bypass dell'autenticazione CVE-2020-14882 e al relativo vettore di esecuzione di codice remoto CVE-2020-14883. Lo script invia una...

FreePBX-Multiple-CVEs-2025

FreePBX-Multiple-CVEs-2025 Questo repository documenta tre vulnerabilità di sicurezza scoperte in FreePBX CVE-2025-66039, CVE-2025-61678, CVE-2025-61675, inclusi analisi, impatto e dettagli di proof-of-concept per scopi di ricerca e sensibilizzazione sulla sicurezza. Descrizione CVEs 🔴...

CVE-2025-63307

CVE-2025-63307 – Cross-site Scripting XSS persistente autenticato in laravel-file-manager v3.3.1 🧭 Panoramica Una vulnerabilità di Cross-site Scripting XSS persistente autenticato in laravel-file-manager v3.3.1 e versioni precedenti consente ad attaccanti con accesso all'interfaccia del file...

CVE-2026-16639 Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0...

CVE-2026-16639

CVE-2026-16639 is a critical authentication bypass in the Drupal Internationalization Single Sign-On module (versions 0.0.0 through 1.8.0). The module, used in multilingual websites with separate domain names per language, fails to sufficiently validate a short-lived token , allowing an attacker ...