artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

PoC-CVE-2025-29927

PoC-CVE-2025-29927 what is the vuln? this cve reports an flaw in the header x-middleware-subrequest, responsible to takes internal requests in next.js, who allow an attacker bypass the authorization middlewares in next.js 15.0.0 and acess protected routes, for example real example in a webapp,...

CVE-2024-28987-POC

Description : The SolarWinds Web Help Desk WHD software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data. Potential impact : Exploitation of CVE-2024-28987 could allow an attacker to bypass security policies...

CVE-2018-10933

libSSH-Authentication-Bypass Spawn to shell without any credentials by using CVE-2018-10933 Exploit-DB : https://www.exploit-db.com/exploits/45638 Information about CVE-2018-10933 by libSSH : https://www.libssh.org/security/advisories/CVE-2018-10933.txt Bugfix Release by libSSH :...

EUVD-2026-75585

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2023-27524

CVE-2023-27524 Description - POC for CVE-2023-27524: Apache Superset Auth Bypass Vulnerability. - create by antx at 2023-04-27. Detail - Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY...

CVE-2025-53694

CVE-2025-53694: Information Disclosure in ItemService API with a restricted anonymous user, leading to exposure of cache keys using a brute-force approach The ItemService API, accessible at /sitecore/shell/api/sitecore/ItemService/GetChildren, allows unauthenticated users to query the Sitecore...

CVE-2024-9106

CVE-2024-9106 Wechat Social login = 1.3.0 - Authentication Bypass Description: The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verification on the user being supplied during the social login...

CVE-2026-39987

CVE-2026-39987 - marimo Terminal WebSocket Authentication Bypass poc Overview This repository contains CVE-2026-39987 affecting marimo versions before 0.23.0. The vulnerability exists in the terminal WebSocket endpoint, where insufficient authentication enforcement may allow an unauthenticated...

mySCADA-myPRO-7-Hardcoded-FTP-Username-and-Password

mySCADA myPRO 7 Hardcoded Credentials CVE-2018-11311 https://vulners.com/cve/CVE-2018-11311 https://www.exploit-db.com/exploits/44656/ http://myscada.org/wp-content/uploads/downloads/BOXv7/changelog.txt root@kitploit: Changelog v7.0.46 ----------------- - fix of possible vulnerability as describe...

CVE-2021-29441

CVE-2021-29441 Run: CVE-2021-29441.exe ip Alibaba Nacos unauthorized account addition...

CVE-2026-21962

🚨 CVE-2026-21962 - Critical Authentication Bypass Vulnerability 🧾 Summary 🔥 A maximum severity 10.0 vulnerability enabling unauthenticated remote access to Oracle middleware systems. root@kitploit: CVE ID : CVE-2026-21962 Severity : CRITICAL Published : 2026-01-20 Category : Authentication Bypass...

CVE-2026-33340

CVE-2026-33340: SSRF in lollms-webui Overview Field| Detail ---|--- CVE ID| CVE-2026-33340 Vulnerability| Server-Side Request Forgery SSRF Affected Product| ParisNeo/lollms-webui LoLLMs WEBUI Severity| Critical — CVSS 9.1 CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-918:...

CVE-2025-9074-Docker-Desktop-Container-Escape

CVE-2025-9074: Docker Desktop Container Escape PoC Proof of Concept exploit for CVE-2025-9074 - a critical container escape vulnerability in Docker Desktop that allows unauthenticated access to the Docker Engine API. Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2025-9074 CVSS Score|...

CVE-2025-49132

CVE-2025-49132 Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute...

CVE-2026-84821 WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...

EUVD-2026-75520

Unauthenticated Broken Authentication in IMPress for IDX Broker = 3.3.0 versions...

CVE-2026-66674 WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability

Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...

Vulnerability fixed in Fortinet FortiOS

Fortinet has fixed a vulnerability in FortiOS FortiSASE and FortiSwitchManager specifically. The vulnerability is located in the cwacd daemon in FortiOS and FortiSwitchManager. This daemon is vulnerable to exploitation by remote, unauthenticated attackers. By sending specially crafted packets or...