814 matches found
cve-2020-13933
cve-2020-13933 cve-2020-13933 Apache Shiro privilege bypass vulnerability This reproduction is very simple. First, set up the environment using IDEA + Shiro Reference: https://www.cnblogs.com/ph4nt0mer/p/13535999.html Then run, access, and capture packets...
CVE-2021-36750
CVE-2021-36749 About - In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server...
CVE-2025-20029
CVE-2025-20029: Command Injection in TMSH CLI in F5 BIG-IP A command injection vulnerability exists in the F5 “tmsh” restricted CLI which allows an authenticated attacker to leverage the commands accessible by a low privilege user in order to bypass restrictions, inject arbitrary commands and...
YellowKey-Bitlocker-CVE-2026-45585
🛡️ YellowKey-Bitlocker-CVE-2026-45585 - Recover Your BitLocker Keys Safely 📋 What This Software Does YellowKey is a free open-source utility for Windows 10 and Windows 11. It helps you extract, backup, and view your BitLocker recovery keys. This is useful if you lost access to your encrypted drive...
CVE-2026-62967 ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser
ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an administrator, through POST /api/auth/user/invalidateUser. In...
CVE-2026-62967
Prior to version 0.8.0 , ZTNET (a ZeroTier web UI) is vulnerable to a privilege bypass in the src/pages/api/auth/user/invalidateUser.ts handler. The root cause is a missing authorization check where getServerSession verifies only the existence of a session but fails to validate that the session.u...
CVE-2026-62967 ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser
ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an administrator, through POST /api/auth/user/invalidateUser. In...
cvebench-evidence
BountyKai on CVE-Bench — results & evidence 21 of 40 real-w...
Wazuh check_token() Privilege Bypass
The vulnerability of the checktoken function on the security monitoring and threat detection platform Wazuh is related to an incorrect session duration. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms and gain increased privileges...
Astra Linux – vulnerability in docker.io-app
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability was identified that allows bypassing privilege validation for Docker plugins during installation. Due to an error in the daemon’s privilege comparison logic, it may incorrectly accept a privilege set tha...
CVE-2026-71490
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write...
CVE-2026-71490 OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write...
CVE-2026-71490 OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write...
rosenbridge
project:rosenbridge : puertas traseras de hardware en CPUs x86 github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax Resumen project:rosenbridge revela una puerta trasera de hardware en algunos procesadores x86 de escritorio, portátiles y embebidos. La puerta trasera permite que el código...
EUVD-2026-89144
Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. Chromium security severity: Medium...
CVE-2026-87544
A flaw was found in Chromium. A remote attacker could exploit incorrect authorization in Extensions by crafting a malicious HTML page. This could allow the attacker to bypass system access restrictions and gain access to a privileged page...
EUVD-2026-44773
Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces...
CVE-2026-77243
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, ENABLEDTOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke...
CVE-2026-77243 MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, ENABLEDTOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke...
CVE-2026-77243
The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to an authorization bypass in versions prior to 0.22.0 . The root cause is that while ENABLED_TOOLS and TOOLSETS are applied during tool listing, they are not rechecked when a tools/call request is dispatched. T...