CVE-2026-20180

Cisco ISE RCE: Advanced Exploitation and Remediation Analysis 📋 Table of Contents 1. Executive Summary 2. Attack Surface Analysis 3. Exploitation Vectors 4. Advanced Evasion Techniques 5. Systemic Impact on Zero Trust Architectures 6. Remediation Strategy 7. Forensic Investigation 8. References 🎯...

cve-2021-45232-exp

apisixdashboardrce Don't be evil...

Check-Point-Trusted-Access-Review

Check Point Trusted Access Review PLEASE ALWAYS APPLY VENDOR PATCHES AS QUICKLY AS POSSIBLE Local web app for conducting a Check Point Trusted Access Review with trusted Check Point Management API commands. Most checks are review-only. Any available remediation action requires explicit operator...

Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read

Amazon rabbitmq-aws versions 0.1.0 through 0.2.0 contain active debug code in the ARN resolver. An authenticated RabbitMQ user with management API access can submit an arn:aws-debug:file ARN to the validation endpoint and read arbitrary files accessible to the RabbitMQ process. id: CVE-2026-9133...

UniFi Access - Broken Access Control

UniFi Access Application 3.3.22 through 3.4.31 contains a broken authentication caused by misconfiguration exposing management API without proper authentication, letting attackers on management network access management functions, exploit requires network access. id: CVE-2025-52665 info: name:...

CheckPoint-CVE-Webscanner

CP VPN CVE Scanner An approval-based local webapp for scanning configuration markers associated with Check Point CVE-2026-50751, CVE-2026-50752, CVE-2026-85102, and CVE-2026-85103 and applying selected mitigations through Check Point Management API commands. This tool is not created or supported ...

CVE-2026-100307

Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafte...

CVE-2026-100307 Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator

Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafte...

CVE-2026-100307

Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafte...

CVE-2026-100307 Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator

Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafte...

CVE-2026-100307

Amazon mcp-gateway-registry versions 1.0.9 through 1.24.7 are vulnerable to a missing authorization flaw in the external management API . This vulnerability allows an authenticated remote user to send a crafted group import request to assign the registry administrator scope to their own identity ...

EUVD-2026-124009

Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafte...

EUVD-2026-123015

AsiaInfo Business Support System BSS 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative...

PT-2026-145448

Name of the Vulnerable Software and Affected Versions Amazon mcp-gateway-registry versions 1.0.9 through 1.24.7 Description Missing authorization in the external management API allows an authenticated remote user to obtain administrative control of every registered gateway asset. This is achieved...

CVE-2026-100307: AWS mcp-gateway-registry: Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an…

Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafte...

CVE-2026-125297

AsiaInfo Business Support System BSS 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative...

CVE-2026-125297

The AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 are vulnerable to a critical security flaw where the management API '/bss/sysmgnt/api/' accepts unauthenticated requests . This vulnerability (categorized under CWE-306 and CWE-862 ) allows a remote, unauthenticated attacker...

CVE-2026-126128

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes...

CVE-2025-54914-PoC

CVE-2025-54914 Azure Route Exploit Overview This is an improved implementation of the CVE-2025-54914 Azure Networking Route exploit. This version maintains the core CVE functionality while adding more features including persistence, evasion, multi-target scanning, and error handling. Features Cor...

CVE-2026-126128

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes...