CVE-2026-21962

🚨 CVE-2026-21962 - 치명적인 인증 우회 취약점 🧾 요약 🔥 Oracle 미들웨어 시스템에 인증되지 않은 원격 액세스 를 가능하게 하는 최대 심각도10.0 취약점입니다. CVE ID : CVE-2026-21962 Severity : CRITICAL Published : 2026-01-20 Category : Authentication Bypass CWE : CWE-284 Improper Access Control 🧠 기술적 분석 - Authentication boundary is improperly enforced...

CVE-2022-1388

CVE-2022-1388 На версиях F5 BIG-IP 16.1.x до 16.1.2.2, версиях 15.1.x до 15.1.5.1, версиях 14.1.x до 14.1.4.6, версиях 13.1.x до 13.1.5, а также всех версиях 12.1.x и 11.6.x нераскрытые запросы могут обойти аутентификацию iControl REST. Используйте следующую однострочную команду cURL для проверки...

CVE-2018-18820

CVE-2018-18820 Icecast 서버용 CVE-2018-18820 체커 추가 정보는 필요 없으며, 모든 컨텍스트는 main.py 파일 안에 있습니다. 필요한 것은 requests뿐인데, 우리 모두 이미 가지고 있습니다...

CVE-2022-24112

CVE-2022-24112 Apache APISIX apisix/batch-requests RCE...

CVE-2026-66247

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

CVE-2026-66247

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

CVE-2026-66247

The iControl software is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability. This flaw could allow a malicious website to execute cross-origin requests that include the victim's credentials. If exploited, an attacker could access and exfiltrate sensitive data within...

EUVD-2026-90814

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

CVE-2025-45250

CVE-2025-45250 제안된 설명 MrDoc =0.95 is vulnerable to Server-Side Request Forgery SSRF in the validateurl function of the appdoc/utils.py file. POC POST /uploaddocimg/ HTTP/1.1 Host: ip:port Accept-Encoding: gzip, deflate DNT: 1 Cookie: your cookie User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...

CVE-2026-94250

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...

cve-2024-24919

정찰 도구 설치 1. git clone https://github.com/satchhacker/cve-2024-24919.git 2. cd cve-2024-24919 3. chmod +x cve-2024-24919.sh 4. ln -s $pwd/cve-2024-24919.sh /usr/bin/cve-2024-24919.sh 도구를 사용하려면 다음을 실행하세요: cve-2024-24919 사용법 이 도구는 제공한 도메인 파일에 있는 IP/도메인에 curl 요청을 보내고 CVE-2024-24919에 대해 테스트합니다. 면책 조항 ...

Vehicle-Service-Management-System-Service-Requests-Stored-Cross-Site-Scripting-XSS

CVE-2021-46070 Exploit Title: Vehicle Service Management System - 'Service Requests' 저장형 교차 사이트 스크립팅 XSS Exploit Author: SANU P.L CVE: CVE-2021-46070 CVSS: 4.8 MEDIUM 참조: https://www.plsanu.com/vehicle-service-management-system-service-requests-stored-cross-site-scripting-xss...

CVE-2026-88789

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-103245

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

CVE-2026-94250 Apache APISIX: Batch response aggregation can exhaust worker memory

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...

CVE-2026-94250

Apache APISIX versions 1.3.0 through 3.18.0 are vulnerable to an allocation of resources without limits or throttling flaw within the batch-requests plugin . An unauthenticated caller can trigger an Out of Memory (OOM) condition on a gateway worker by targeting a route where the batch-requests pl...

EUVD-2026-90767

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...

CVE-2026-94250 Apache APISIX: Batch response aggregation can exhaust worker memory

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...

CVE-2026-88789

The camel-quarkus-support-xalan extension in Apache Camel Quarkus (versions 3.2.0 to 3.33.3 and 3.34.0 to 3.40.0) is vulnerable to CWE-611 due to a forced Xalan TransformerFactory that fails to honor JAXP external access restrictions. An attacker providing an XML document transformed via the xslt...

EUVD-2026-90684

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...