CVE-2026-26012

CVE-2026-26012 — Vaultwarden Cipher Enumeration PoC Vollständige Cipher-Enumeration unter Umgehung der Sammlungsberechtigungen der Organisation Ein Proof-of-Concept-Exploit für CVE-2026-26012, eine Schwachstelle durch fehlerhafte Zugriffskontrolle in Vaultwarden = 1.35.2, die es jedem...

CVE-2026-1529

Ferramenta de Exploração CVE-2026-1529 Keycloak CVE-2026-1529 : Keycloak - Registro não autorizado de organização via validação inadequada de token de convite ⚠️ AVISO : Esta ferramenta é apenas para fins educacionais e de testes de segurança autorizados. O acesso não autorizado a sistemas de...

Benchmark

OWASP Benchmark 项目的 GitHub 仓库已迁移。现在有一个新的 OWASP Benchmark GitHub 组织，地址为： https://github.com/OWASP-Benchmark 原来的 https://github.com/OWASP/Benchmark 现在变更为：https://github.com/OWASP-Benchmark/BenchmarkJava 随着时间的推移，新的 OWASP Benchmark 项目将添加更多子项目，例如 BenchmarkUtils、BenchmarkDotNet 等。...

Pentest-Collaboration-Framework

Pentest Collaboration Framework Pentest Collaboration Framework - an opensource, cross-platform and portable toolkit for automating routine processes when carrying out various works for testing! Explore the docs » ‼️ Important Links...

git-alerts

GitAlerts Che problema risolve? I repository GitHub creati all'interno di qualsiasi organizzazione possono essere controllati dagli amministratori di GitHub. Tuttavia, qualsiasi repository creato sotto l'account utente di un'organizzazione non è controllabile a meno che l'organizzazione non abbia...

git-all-secrets

git-all-secrets About git-all-secrets is a tool that can: Clone multiple public/private github repositories of an organization and scan them, Clone multiple public/private github repositories of a user that belongs to an organization and scan them, Clone a single public/private repository of an...

CVE-2026-19197

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

CVE-2026-19197 Broken access control in dashboard snapshots

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

CVE-2026-19197 Broken access control in dashboard snapshots

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

CVE-2026-79654

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View...

CVE-2026-79654 Ketello: katello content view history api cross-organization authorization bypass

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View...

CVE-2026-79654 Ketello: katello content view history api cross-organization authorization bypass

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View...

CVE-2026-79654

Katello 's Content View History API fails to properly enforce authorization when a user-supplied identifier is used to retrieve a Content View's lifecycle history. An authenticated user with view permissions in one organization can supply the identifier of a Content View belonging to a different ...

CVE-2026-79654

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View...

CVE-2026-80192

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

CVE-2026-80192

@better-auth/sso contains two domain-ownership authentication bypass flaws affecting versions before 1.6.27 (and before 1.4.8 in the 1.4.x line, before 1.7.0-rc.5 in the 1.7 prerelease line). When domain verification is disabled , an authenticated organization owner/administrator can register an ...

CVE-2026-80192 better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

BIT-KEYCLOAK-2026-2366 Keycloak: keycloak: information disclosure via authorization bypass in admin api

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim'...

cloud

Cloud Monitoring the Cloud Landscape Our mission with this project is to provide an always up-to-date and freely accessible map of the cloud landscape for every major cloud service provider. We've decided to kick things off with collecting SSL certificate data of AWS EC2 and GCP machines,...

CVE-2026-75542

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...