APTS

What is OWASP APTS? A governance standard for autonomous penetration testing platforms. It defines what these systems must do to operate safely, transparently, and within defined boundaries, whether they are delivered by vendors, operated as a service, or built in-house by enterprise security tea...

edu-recon

edu-recon 面向教育行业红蓝对抗演练 的授权侦察与分诊编排器。 放入目标，它就会运行扫描器、过滤噪声，并在 Web UI 中交给你一个按优先级排序的 待审队列。专为部署在你的 Linux 机器（Kali / 基础设施）上、通过浏览器驱动而构建。 ⚠️ 仅限授权使用。 只可指向你已获授权测试的系统。 范围锁定默认关闭 ——授权由操作者负责。对于真实 交战，你可以在 config.yaml 中通过 scopeenforce: true 重新启用锁定的范围允许列表（此后每个阶段在执行前都会重新检查范围）。 快速开始 · 复制粘贴即可 Kali / Debian / Ubuntu ——...

AZL-98307 CVE-2026-40205 affecting package dovecot 2.3.20-1

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...

ALPINE-CVE-2026-40205

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...

EUVD-2026-67671

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...

CVE-2026-40205

Open-Xchange (OX) is affected by an OAuth2 token validation flaw in its remote validation paths . When the configuration requires more than one scope, the remote path accepts a token carrying only one of the required scopes, whereas the local validation path correctly enforces all of them. This m...

UBUNTU-CVE-2026-40205

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...

CVE-2026-40205

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...

CVE-2026-80204

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

CVE-2026-80203

The getgrav/grav-plugin-api plugin before 1.0.18 contains an authentication bypass in the requireNotSuperTarget() function within UsersControllers.php, affecting seven sensitive user-management endpoints. The root cause is that the scope check calls isSuperAdmin() on the acting account rather tha...

PT-2026-82078

Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.18 Description The injectSecurityTab function within the BlueprintController fails to apply the API-key scope cap when determining if a page's security or permissions blueprint...

PT-2026-82077

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.18 Description The getgrav/grav-plugin-api plugin fails to enforce API-key scope within the requireNotSuperTarget function located in UsersController.php across seven sensitive user-management...

CVE-2026-79672

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

CVE-2026-79672 Ech0 before 4.4.3 Authentication Bypass via Comment Panel

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

CVE-2026-79672 Ech0 before 4.4.3 Authentication Bypass via Comment Panel

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

EUVD-2026-65442

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

CVE-2026-79672

Ech0 before version 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints. Attackers holding a limited-scope access token can bypass intended restrictions to perform full comment moderation operations, including listing, approving, rejecting, and deleting comments...

EUVD-2026-65447

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-79667 Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-79667

Ech0 versions 4.3.4 and earlier fail to enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Endpoints such as /api/inbox, /api/panel/comments, and /api/backup/export authorize based only on the user's admin role, omitting scope checks. The backup export ...