93 matches found
CVE-2026-34926
⚠️ Security Research & Legal Disclaimer 📌 Purpose of This Repository This repository is provided strictly for educational, academic, and authorized cybersecurity research purposes only. It is intended to support understanding of: Security vulnerabilities and exploitation concepts in controlled...
Vulnerability related to Apache Qpid Proton C encryption issues
Apache Qpid Proton C versions 0.40.0 and earlier contain an encryption-related vulnerability. This issue arises when OpenSSL TLS is used; the pnssldomainsettrustedcadb and pntlsconfigsettrustedcerts APIs add rather than replace default system trust anchors, potentially leading to unauthorized use...
CVE-2026-102583
A flaw exists in Moodle due to an incorrect capability check within the artificial intelligence (AI) editor placement's image generation web service. This vulnerability allows an authenticated user to bypass required permissions to invoke the feature, resulting in unauthorized access and usage of...
CVE-2026-56681
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip...
CVE-2026-56681: Reliance on Untrusted Inputs in a Security Decision
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip...
Exploit for CVE-2026-19478
cve-id Donate Support the maintenance of this project wit...
golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the...
CVE-2026-54397
A vulnerability in MISP’s non-REST event editing path allowed an authenticated user with event edit permissions to manipulate the submitted form data and set an event’s sharinggroupid to a sharing group they were not authorized to use. When distribution was set to sharing group distribution, the...
ABIS BAPSİS security vulnerabilities
ABIS BAPSİS is a research information system developed by the Turkish company ABIS, aimed at university research projects, academic budgets, and administrative processes management. Previous versions of ABIS BAPSİS, such as v.202604152042, contained security vulnerabilities. These vulnerabilities...
CVE-2026-40904 Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes multiple dataset and dataRequest endpoints that authorize low-privileged project members at the team level instead of binding the...
CVE-2026-40904
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes multiple dataset and dataRequest endpoints that authorize low-privileged project members at the team level instead of binding the...
Keycloak services allows the issuance of access and refresh tokens for disabled users
A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a...
EUVD-2020-28378
Malware in sbrugna...
EUVD-2023-57845
Malicious code in bioql PyPI...
EUVD-2024-50035
Malicious code in bioql PyPI...
CVE-2025-46018: Authentication Bypass by Spoofing
CSC Pay Mobile App 2.19.4 fixed in version 2.20.0 contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specific point during a transaction. This could result in unauthorized use of laundry services and potential financial loss...
Opay Mobile Application Security Vulnerability
Opay Mobile application is a lightweight application from Opay Inc. It is used to manage all banking or payment requirements. A security vulnerability exists in Opay Mobile application version 2.19.4, which originated from allowing a user to bypass payment authorization by disabling Bluetooth at ...
Exploit for CVE-2025-2294
CVE-2025-2294 - WordPress Kubio AI Page Builder Request/Res...