CVE-2024-38063

CVE-2024-38063 Windows Vulnerability that allows the implementation of unauthorised activity over the network: remote execution of Windows TCP/IP remote code. Two virtual machines - a victim and an attacker - are ready to simulate the attack. On the victim machine, a tool for capturing network...

CVE-2018-2894

CVE-2018-2894 CVE-2018-2894 WebLogic unauthorized access leading to arbitrary file upload/RCE vulnerability check script...

CVE-2025-22828

CVE-2025-22828 📜 Description Apache CloudStack 4.16.0 and later versions have a broken access control issue that allows users with knowledge of resource UUIDs to read or add comments annotations on resources they are not authorized to access. UUIDs can be exposed in various parts of the...

kubolt

Wat? Kubolt is simple utility for scanning public unauthinticated kubernetes clusters and run commands inside containers Why? Sometimes, the kubelet port 10250 is open to unauthorized access and makes it possible to run commands inside the containers using getrun function from kubelet: // getRun...

blackjump

blackjump 简体中文 | English Legal Disclaimer: This tool is only intended for legally authorized enterprise security construction activities. When using this tool for testing, you should ensure that the behavior complies with local laws and regulations and has obtained sufficient authorization. Do no...

EUVD-2026-94000

Backstage has improper authorization in GitLab organizational user ingestion...

GHSA-GP6M-X9VW-5C5X Backstage has improper authorization in GitLab organizational user ingestion

Impact Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticate...

EUVD-2026-94068

Backstage: Scaffolder action input authorization bypass...

GHSA-HMP2-4M7G-22CV Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...

Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...

CVE-2026-106586

A flaw was found in OpenSSH. In configurations where tunnel forwarding is enabled on the server, the restrict option in the authorized keys configuration fails to properly block tunnel forwarding requests. An authenticated user connecting with a restricted key can exploit this issue to bypass...

CVE-2021-27289

🐝 CVE-2021-27289: Playback Protection Bypass on Ksix Zigbee devices 📑 Table of Contents Before We Get Serious The Story Behind This CVE Vulnerability Affected Devices Technical Details Attack Scenario Impact Proof of Concept Demo Videos Original Blog Post Researcher Zigbee Basics Background and...

CVE-2019-3396

CVE-2019-3396 Confluence Unauthorized RCE CVE-2019-3396 Vulnerability Pitfall: Some versions require adding Referer to succeed File Read POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: 10.10.20.181 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:55.0 Gecko/20100101 Firefox/55.0 Accept:...

CVE-2026-106496

A flaw was found in the Backstage plugin-catalog-backend component. Due to inconsistent enforcement of allowed location types during catalog processing, an authenticated remote attacker can submit location targets that should be restricted under specific configurations. This flaw can enable the...

CVE-2026-106562

A flaw was found in Backstage search backend plugins. In deployments configured with permission enforcement and backed by an Elasticsearch or OpenSearch service, search engine filtering fails to properly apply document denial policies. An authenticated user can exploit this issue during search...

CVE-2026-106461

A flaw was found in plugin-scaffolder-backend. An improper authorization flaw allows an authenticated user to view task metadata outside their intended permissions, resulting in unauthorized information disclosure. This vulnerability occurs during scaffolder task listing when deployment permissio...

CVE-2026-20328

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during th...

CVE-2021-45232

CVE-2021-45232 CVE-2021-45232 POC 1、Apache APISIX Dashboard unauthorized access vulnerability CVE-2021-45232 scan 2、Apache APISIX Dashboard default password scan...

CVE-2025-29972

CVE-2025-29927 - Critical Security Vulnerability in Next.js Overview CVE-2025-29927 is a critical security vulnerability affecting Next.js , a popular React framework for building full-stack web applications. This flaw allows attackers to bypass authorization checks implemented in Next.js...

CVE-2021-22192

CVE-2021-22192 CVE-2021-22192 Range: Unauthorized User RCE Vulnerability 0x10 Range Environment 0x20 Directory Structure CVE-2021-22192 ├── README.md ............... This README ├── imgs .................... Images for README ├── gitlab .................. Gitlab container mount directory │ ├──...