Talon

Talon Talon is a 3rd party agent for Havoc written in C. It's very minimalistic and it's meant to show how to work with the Havoc service api. Talon.py is the script that handles callbacks, register reqeuest and tasks by interacting with the Havoc service api...

CVE-2026-62183

CVE-2026-62183 — Apache Syncope user self-service privilege escalation Improper Privilege Management CWE-269 in Apache Syncope. An authenticated, low-privilege user can grant themselves arbitrary roles and group memberships, external resources, and a new realm through the user self-service API —...

CVE-2026-107058

An issue in Shelter versionCode 445 allows attackers to register their own authkey and execute a takeover of another user's binder service API and preference state...

CVE-2026-107058

An issue in Shelter versionCode 445 allows attackers to register their own authkey and execute a takeover of another user's binder service API and preference state...

PT-2026-132389

Name of the Vulnerable Software and Affected Versions Shelter version 445 Description An issue allows attackers to register their own auth key, enabling the takeover of another user's binder service API and preference state. This allows an attacker to gain control over the API access and preferen...

CVE-2026-107058

An issue in Shelter versionCode 445 allows attackers to register their own authkey and execute a takeover of another user's binder service API and preference state...

EUVD-2026-113256

An issue in Shelter versionCode 445 allows attackers to register their own authkey and execute a takeover of another user's binder service API and preference state...

CVE-2026-107058

An issue in Shelter (versionCode 445 ) allows attackers to register their own auth_key , leading to the takeover of another user's binder service API and preference state . The root cause is categorized as Improper Authentication (CWE-287). No specific remediation or exploit details are provided ...

EUVD-2026-106795

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher...

CVE-2026-91590

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher...

CVE-2026-91590

A vulnerability exists in the Web Service API component of Oracle BI Publisher (part of Oracle Analytics). Affected versions include 8.2.0.0.0 and 26.01.0.0.0 . This easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the product, provided they can ...

PT-2026-120072

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher...

Oracle BI Publisher security vulnerability

Oracle BI Publisher versions 8.2.0.0.0 and 26.01.0.0.0 have security vulnerabilities. These vulnerabilities stem from issues with the Web Service API component. Vulnerable attackers with low privileges could access the system via the HTTP network. This allows them to update, insert, or delete...

CVE-2026-105206

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

CVE-2026-105206

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

CVE-2026-105206

ZITADEL versions 3.0.0 through 3.4.15 and 4.x before 4.17.3 are vulnerable to an incorrect authorization flaw in the User Service API . The vulnerability exists because the system verifies the user.read permission against the caller's organization rather than the organization that owns the target...

CVE-2026-105206 ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

EUVD-2026-92099

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

CVE-2026-105206 ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

PT-2026-104630

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...