CVE-2026-105396 Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

CVE-2026-105396

The Heym library (versions before v0.0.112 ) is vulnerable to a token leakage flaw within the build_public_base_url() function. An unauthenticated attacker can spoof Origin or X-Forwarded-Host headers to redirect HITL (Human-in-the-Loop) review links to an attacker-controlled domain. By triggerin...

EUVD-2026-92414

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

CVE-2026-105396 Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

cve-2026-21858

CVE-2026-21858 + CVE-2025-68613 - Cadena Completa de n8n Lectura Arbitraria de Archivos sin Autenticación → Forja de Token de Admin → Bypass de Sandbox → RCE | ---|--- CVE| CVE-2026-21858 AFR + CVE-2025-68613 RCE CVSS| 10.0 + 9.9 Crítico Afectado| = 0.211.0 RCE Corregido| 1.121.0 AFR / 1.120.4+ R...

CVE-2018-0114

CVE-2018-0114 antes de 0.11.0 un atacante remoto no autenticado puede volver a firmar utilizando una clave incrustada en el token. https://www.cvedetails.com/cve/CVE-2018-0114/...

CVE-2025-26399

CVE-2025-26399 ¿Cómo funciona este método de detección? Este script detecta instancias de SolarWinds Web Help Desk vulnerables a CVE-2025-26399 solicitando la página de inicio de sesión de Helpdesk, confirmando identificadores de producto en la respuesta, extrayendo el token de compilación...

CVE-2026-69836-EXP

CVE-2026-69836 Entra ID Unauthenticated RCE Proof of Concept Overview CVE-2026-69836 is a critical unauthenticated remote code execution vulnerability in Microsoft Entra ID due to improper deserialization of untrusted data CWE-502. The flaw allows attackers to execute arbitrary code over the...

CVE-2026-103511

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...

CVE-2026-103510

P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server...

CVE-2026-100103

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the...

CVE-2525-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-in-HotelDruid-3.0.7

CVE-2025-25748-Vulnerabilidad-de-Cross-Site-Request-Forgery-CSRF-en-HotelDruid-3.0.7 Descripción Una vulnerabilidad de Cross Site Request Forgery CSRF en el endpoint gestioneutenti.php de HotelDruid 3.0.7 permite a los atacantes realizar acciones no autorizadas por ejemplo, modificar contraseñas ...

CVE-2026-103510

P4 Search versions prior to 2026.4.2 are vulnerable to an authentication bypass because the service does not fail securely when presented with a blank authentication token . An unauthenticated attacker with network access can exploit this flaw to obtain highest application privileges , potentiall...

CVE-2026-103510 Authentication bypass via blank auth token in P4Search

P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server...

CVE-2026-103511 Arbitrary file-write via extension installation in P4Search

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...

CVE-2026-103511

Prior to version 2026.4.2 , Perforce P4 Search is vulnerable to an arbitrary file-write flaw. The software fails to validate file names provided to its extension installation feature . An attacker possessing super-user or service-token privileges can exploit this to write files containing arbitra...

CVE-2026-100103 Authentication bypass via default auth token in P4Search

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the...

EUVD-2026-92291

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the...

CVE-2024-25175

CVE-2024-25175 XSS Reflejado mediante División de Respuesta HTTP Descripción : La explotación de esta vulnerabilidad puede llevar a la ejecución de código JavaScript en el navegador de la víctima Cross-Site Scripting al seguir un enlace especialmente diseñado. La vulnerabilidad surge porque el...

CVE-2024-27198_LAB

Laboratorio CVE-2024-27198 Descripción TeamCity proporciona una página solo para administradores para la gestión de tokens que no está protegida por autenticación. Esto permite que un usuario no autenticado genere un token de acceso para el usuario administrador si puede encontrar un ID de un...