CVE-2020-3580

This repository does not have a README...

SNP

This repository does not have a README...

PoC-for-CVE-2021-38540-

CVE-2021-38540 Proof of Concept Missing Authentication on Critical component Known as CVE-2021-38540 About this bug: The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, variables List Variables PoC Source: POST /variable/varimport HTTP/2 Host:...

CVE-2026-48558

CVE-2026-48558: SimpleHelp OIDC Authentication Bypass !WARNING This code is provided AS IS for educational and research purposes only. Do not use this PoC on production systems, shared environments, or any unauthorized targets. This exploit demonstrates a critical remote code execution RCE...

EUVD-2026-97560

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28...

NotCVE-2026-0010

Summary Vulnerability: Unauthenticated IPC Local Privilege Escalation to SYSTEM via Barrier Daemon TCP Port 24801 Vendor: debauchee Barrier project Product: Barrier 2.4.0 final release, 2021-11-01 CWE: CWE-306: Missing Authentication for Critical Function Description Barrier's Windows service...

CVE-2023-4800

CVE ID: CVE-2023-4800 Vulnerability Type: Sensitive Data Exposure Description: The DoLogin Security plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dashboard widget in versions up to, and including, 3.7. This makes it possible for...

CVE-2026-56164-EXP

Microsoft SharePoint Server Elevation of Privilege - CVE-2026-56164 Functional unauthenticated EOP exploit. Overview Missing authentication for critical function CWE-306 in SharePoint Server user profile and site collection endpoints. Allows remote attackers to escalate from anonymous to Site...

ghostlock-honor-aak-probe

This repository does not have a README...

bloodit

This repository does not have a README...

CVE-2026-109371

The ZITADEL identity platform versions 3.0.0 before 4.18.0 is vulnerable to a missing authentication flaw in the hosted Login V1 UI . The root cause is that the change-username handler processes account modifications before verifying any authentication factors. This allows unauthenticated attacke...

EUVD-2026-97669

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username...

CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username...

CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username...

CVE-2026-109356 LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

EUVD-2026-97658

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

CVE-2026-109356

LibreNMS versions before 26.9.0 are susceptible to a missing authorization vulnerability in the PortsController::purge function. This flaw allows users with global-read (read-only) accounts to bypass necessary delete privileges by sending DELETE requests to the /ports/purge endpoint. By utilizing...

CVE-2026-109342

SurrealDB versions 3.0.0 before 3.3.0 are vulnerable to a missing authentication flaw in the revoke RPC method . This allows low-privileged or unauthenticated callers to permanently revoke other users' refresh tokens without proof of possession. Attackers can acquire necessary grant identifiers u...

EUVD-2026-97644

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can obtain grant identifiers via ACCESS SHOW ALL with...

CVE-2026-109342 SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can obtain grant identifiers via ACCESS SHOW ALL with...