736 matches found
CVE-2025-29927
CVE-2025-29927 - Next.js Middleware Authentication Bypass Advanced Bypass 🔥 Overview An advanced PoC for CVE-2025-29927 , allowing authentication bypass in Next.js Middleware by manipulating specific headers. This template enhances WAF evasion and security bypass techniques. 🚀 Features ✅...
CVE-2026-94197
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller NIC when configured with the ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and...
EUVD-2026-101118
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller NIC when configured with the ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and...
CVE-2026-94197
An authentication and authorization bypass vulnerability exists in the F5 NGINX Ingress Controller when configured with the ExternalAuth policy or Ingress external authentication. The root cause is the unsanitized forwarding of client-supplied headers, specifically X-Forwarded-Prefix , X-Forwarde...
CVE-2026-94197: Authentication Bypass by Spoofing
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller NIC when configured with the ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and...
CVE-2026-66568
Unauthenticated PHP Object Injection in Original = 1.9.0 versions...
CVE-2026-66568
The WordPress Original theme (versions
EUVD-2026-96522
Unauthenticated PHP Object Injection in Original = 1.9.0 versions...
CVE-2026-66568 WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Original = 1.9.0 versions...
WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Original versions = 1.9.0...
GO-2026-6639 Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis
Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis...
EUVD-2026-44819
Anubis: Policy bypass via client controlled X-Original-URI header...
GHSA-6WCG-MQVH-FCVG Anubis: Policy bypass via client controlled X-Original-URI header
Any HTTP client can bypass Anubis bot protection on the default configuration by adding a single request header. No challenge needs to be solved. Affected versions: v1.22.0 through v1.25.0 introduced in commit d1d631a, PR 1015 The root cause is in lib/policy/checker.go, PathChecker.Check: go func...
Anubis: Policy bypass via client controlled X-Original-URI header
Any HTTP client can bypass Anubis bot protection on the default configuration by adding a single request header. No challenge needs to be solved. Affected versions: v1.22.0 through v1.25.0 introduced in commit d1d631a, PR 1015 The root cause is in lib/policy/checker.go, PathChecker.Check: go func...
PT-2026-104073
Name of the Vulnerable Software and Affected Versions DevKit Pro versions prior to 3.0.0 Description An authentication bypass exists in the DevKit Pro plugin for WordPress. The issue occurs because the revert switch handler trusts the original user id cookie, which is controlled by the attacker, ...
CVE-2026-59317
A flaw was found in Spring for Apache Kafka. The DeadLetterPublishingRecovererFactory component does not properly validate the retrytopic-original-timestamp header. A remote attacker can exploit this by sending a specially crafted message with a malformed header, leading to an infinite processing...
SUSE CVE-2025-64031
libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which...
Linux Distros Unpatched Vulnerability : CVE-2025-64031
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original- filename field to archivecompressorgzipopen in...
UBUNTU-CVE-2025-64031
libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which...
CVE-2025-64031
libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which...