CVE-2026-54631

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...

CVE-2026-54631

The inventory management system Part-DB is vulnerable to session forgery in versions prior to 2.12.1 . The root cause is a hardcoded APP_SECRET (a03498528f5a5fc089273ec9ae5b2849) in the .env file, which is also present in the official jbtronics/part-db1 Docker image. Because Symfony uses this sec...

CVE-2026-54631 Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...

EUVD-2026-108575

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...

PT-2026-121745

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP SECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...

CVE-2024-43044-jenkins

Intro This is an exploit for CVE-2024-43044, an arbitrary file read that allows an agent to fetch files from the controller. The exploit will use the vulnerability to read files to forge a remember-me cookie for an admin account and gain access to Jenkins scripting engine. Check out the full...

CVE-2026-109313

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...

CVE-2026-109313

The Grav Login plugin (versions 2.7.0 before 3.9.9 ) is vulnerable to an authentication bypass (CWE-287). Attackers possessing a valid password can bypass two-factor authentication (2FA) by exploiting the remember-me cookie restoration mechanism. By obtaining a persistent remember-me cookie after...

CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...

EUVD-2026-97615

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...

CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...

PT-2026-110730

Name of the Vulnerable Software and Affected Versions Grav Login plugin versions 2.7.0 through 3.9.8 Description An authentication bypass exists that allows attackers possessing a valid password to circumvent two-factor authentication. This is achieved through remember-me cookie restoration, wher...

CVE-2026-109313: Improper Authentication

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...

Kimai-CVE-2026-49865-POC

Kimai CVE-2026-52824 — Default APPSECRET Authentication Bypass Note: The repository URL contains an outdated CVE ID CVE-2026-49865. The correct and current CVE tracked in this repository is CVE-2026-52824 GHSA-jr9p-4h4j-6c58. Proof-of-concept exploit toolkit for the hardcoded default APPSECRET...

CVE-2026-76949

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

CVE-2026-76949

CVE-2026-76949 is an Authentication Bypass by Spoofing flaw in the Elixir library ash_authentication (by team-alembic). The root cause is a session-key mismatch: sign_in_using_remember_me/3 checks for "_token", but store_in_session/2 only writes that key when require_token_presence_for_authentica...

EUVD-2026-82578

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...