CasaOS < 0.4.4 - Authentication Bypass via Random JWT Token

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...

cve-2025-29927-poc

CVE-2025-29927-POC Introduction This repository contains a Proof of Concept PoC for CVE-2025-29927, a hypothetical vulnerability demonstrating a flaw in middleware handling within a web application. The PoC illustrates how a specially crafted HTTP request can bypass redirection logic to access...

CVE-2024-8963

CVE-2024-8963 Ivanti Cloud Services Appliance - Path Traversal Path Traversal en Ivanti CSA anterior a 4.6 Patch 519 permite a un atacante remoto no autenticado acceder a funcionalidad restringida...

ROS-20261005-73-0005

The vulnerability in rsync relates to incorrect restrictions on the path to the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Azure Logic Apps Path Traversal Privilege Escalation

The vulnerability of the cloud platform for creating and launching automated work processes in Azure Logic Apps is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to increase their privileges remote...

PT-2026-98419

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress plugin versions 1.9 through 3.7.49 Description Insufficient verification occurs when a member requests enrollment in a course. The plugin fails to confirm if the requested course is included in the user's membership...

BuildKit Path Traversal

The vulnerability of the BuildKit container-building software is related to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow a perpetrator to gain unauthorized access to protected information...

Erlang/OTP Path Traversal Unauthorized Access

The vulnerability of the Erlang/OTP software platform is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2026-48073 Docmost: Page export can include restricted same-space attachments through forged attachmentId

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

ROS-20260923-73-0002

The vulnerability in python-black is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

CVE-2026-86481

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...

ROS-20260907-73-0053

The vulnerability in Erlang relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-66000

Frappe (full-stack web framework) has an unrestricted access issue in Document Follow notifications prior to versions 16.23.0 and 15.112.0, where recipient permission checks are not re-evaluated for email data. This allows users whose access has been revoked or reduced to continue receiving docum...

keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

CVE-2026-15573

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

CVE-2026-15573

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

CVE-2026-42955

A "ghost domain names" flaw in Unbound allows a remote attacker controlling a domain to manipulate cached DNS records. By extending the lifetime of outdated DNS information, an attacker can cause clients to receive stale or misleading DNS responses. Mitigation To mitigate this issue, ensure...

Prototype Pollution

Overview n8n-core is a Core functionality of n8n Affected versions of this package are vulnerable to Prototype Pollution in the expression engine. An attacker can cause the application to become unresponsive or crash by manipulating array-element access to obtain a reference to a host built-in an...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the isSafeBin function in the internal/tools/execapproval.go file. An attacker can gain unauthorized access to restricted functionality or data by exploiting insufficient authorization checks remotely...

PT-2026-60544

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0.23...