mkdev

mkdev 로컬 개발을 위한 실제 HTTPS — TUI 및 LAN 공유 지원. mkdev는 .local에서 신뢰할 수 있는 HTTPS를 실행합니다. 단일 Go 바이너리: 인증 기관 + 리버스 프록시 + /etc/hosts + mDNS 브로드캐스트 + 완전한 TUI. 차별점: LAN 공유 — 경로를 공유로 표시하면 같은 Wi-Fi의 휴대폰이나 다른 기기에서 https://app.local에 접속할 수 있습니다. CLI만이 아닌 TUI. 실시간 경로 테이블, 요청 로그, 인증서 검사, 상태 진단. 인자 없이 mkdev를 실행하면...

CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

CVE-2026-72001 — Pangolin 교차 조직 리소스 인증 우회 CVE-2026-72001 에 대한 개념 증명PoC으로, Pangolin 1.22.0의 객체 수준 권한 부여broken-object-level-authorization 결함입니다. 이 취약점을 통해 하나의 리소스 공유 링크 를 보유한 공격자가 인스턴스의 다른 조직이 소유한 리소스를 포함한 모든 다른 리소스 에 대해 유효한 리소스 세션을 발급받을 수 있으며, 설정된 모든 인증 방식SSO, 리소스 비밀번호, PIN, 이메일 허용 목록, 헤더 인증을 우회합니...

CVE-2026-19490-check

Citrix NetScaler SAML nFactor 컨텍스트 인증 우회 — 취약점 탐지 스크립트 Citrix NetScaler ADC / NetScaler Gateway SAML 서비스 제공자 경로의 사전 인증 인증 우회인 CVE-2026-19490 에 대한 안전한 비인증 취약점 점검 도구입니다 CTX696939, 2026-08-19 게시. CWE-288, CVSS v4.0 9.3 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. JPMorgan Chase 침투 테스트 팀의...

grafana: Grafana: Temporary access control bypass for service account token minting

A flaw was found in Grafana. When a user's access to mint tokens for a service account is revoked, the system may temporarily allow the user to continue minting tokens for a few seconds. This could lead to a temporary bypass of access control, potentially enabling unauthorized actions if the toke...

grafana: Grafana: Temporary access control bypass for service account token minting

A flaw was found in Grafana. When a user's access to mint tokens for a service account is revoked, the system may temporarily allow the user to continue minting tokens for a few seconds. This could lead to a temporary bypass of access control, potentially enabling unauthorized actions if the toke...

grafana: Grafana: Temporary access control bypass for service account token minting

A flaw was found in Grafana. When a user's access to mint tokens for a service account is revoked, the system may temporarily allow the user to continue minting tokens for a few seconds. This could lead to a temporary bypass of access control, potentially enabling unauthorized actions if the toke...

Linux Distros Unpatched Vulnerability : CVE-2026-47426

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the privatekeyjwt client authentication path uses ClientJwksResolverCache witho...

CVE-2026-81921

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

CVE-2026-81921 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

CVE-2026-81921 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

CVE-2026-47426

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the privatekeyjwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwksuri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker...

CVE-2026-46498

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core Token Store CTS without an OAuth-only namespace, and OAuthAdapter accepts a row whose BLOB claims to contain an OAuth token without binding...

CVE-2026-47426 OpenAM OAuth Client Impersonation via JWKS Resolver Cache

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the privatekeyjwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwksuri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker...

CVE-2026-47426 OpenAM OAuth Client Impersonation via JWKS Resolver Cache

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the privatekeyjwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwksuri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker...

CVE-2026-47426 OpenAM OAuth Client Impersonation via JWKS Resolver Cache

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the privatekeyjwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwksuri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker...

CVE-2026-47426

OpenAM (Open Access Management) Community Edition through 16.0.6 is affected by an Improper Authentication flaw (CWE-287) in the OAuth2 private_key_jwt client authentication path. The ClientJwksResolverCache does not reliably bind a cached jwks_uri resolver and verified assertion to the expected ...

CVE-2026-46498 OpenAM Arbitrary OAuth Token Minting via Push Registration

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core Token Store CTS without an OAuth-only namespace, and OAuthAdapter accepts a row whose BLOB claims to contain an OAuth token without binding...

CVE-2026-46498 OpenAM Arbitrary OAuth Token Minting via Push Registration

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core Token Store CTS without an OAuth-only namespace, and OAuthAdapter accepts a row whose BLOB claims to contain an OAuth token without binding...