CVE-2026-0257

🚨 CVE-2026-0257 – PAN-OS GlobalProtect Authentication Bypass Security research, technical analysis, detection guidance, IOC collection, and defensive validation resources for CVE-2026-0257. 📌 Overview CVE-2026-0257 is an authentication bypass vulnerability affecting Palo Alto Networks GlobalProte...

CVE-2021-41822

CVE-2021-41822（水的一个） Canon printer unauthorized access vulnerability and denial of service vulnerability The attacker does not need an account or password to access the printer page and obtain information about printed files. And the printer can be turned off remotely. Create denial of service...

CVE-2023-23752

CVE-2023-23752 - إعادة إنتاج ثغرة الوصول غير المصرح به في Joomla استخدام السكربت تثبيت مكتبات بايثون pip install -r requirements.txt التحقق من الثغرة python3 CVE-2022-26134check.py -u url -c whoami المسح الجماعي python3 CVE-2023-23752.py -f urlpart.txt الإصدارات المتأثرة 4.0.0 = Joomla = 4.2.7...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - تثبيت إضافات تعسفي دون مصادقة الوصف ثيم Pubnews في ووردبريس معرّض لثغرة تثبيت إضافات تعسفي غير مصرّح به بسبب غياب فحص الصلاحيات في الدالة pubnewsimporterpluginactionfornotice في جميع الإصدارات حتى 1.0.7 وما يشملها. تسمح هذه الثغرة للمهاجمين المصادقين بصلاحية مستو...

Joomla! Core SQL Injection

A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands. id: CVE-2015-7297 info: name: Joomla! Core SQL Injection author: princechaddha severity: high description: A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote...

Cacti <=1.2.22 - Remote Command Injection

Cacti through 1.2.22 is susceptible to remote command injection. There is insufficient authorization within the remote agent when handling HTTP requests with a custom Forwarded-For HTTP header. An attacker can send a specially crafted HTTP request to the affected instance and execute arbitrary OS...

CVE-2024-50945

CVE-2024-50945 Description SimplCommerce is affected by a Broken Access Control vulnerability in the review system, allowing unauthorized users to post reviews for products they have not purchased. Detection Method An attacker can detect this vulnerability by sending a request to the review...

CVE-2024-24919-POC

CVE-2024-24919 PoC 🚀 🔥 Description This script automates the exploitation of CVE-2024-24919 Checkpoint Security Gateway Unauthorized Information Disclosure. 📌 Features ✅ Single & Bulk URL Testing ✅ Automated Exploitation ✅ Simple & Fast 🛠️ Usage Clone this repo and run the script: git clone...

Electrolink-FM-DAB-TV

Electrolink-FM-DAB-TV لـ CVE-2025-51040 ثغرة وصول غير مصرح به في نظام إدارة الويب لمرسل Electrolink FM/DAB/TV في مرسل Electrolink بقدرة 500W و1kW و2kW من نوع Medium DAB الإصدارات v01.09 وv01.08 وv01.07 ولوحة العرض الإصدارات v1.4 وv1.2 الوصف نظام إدارة الويب لمرسل Electrolink FM/DAB/TV عرضة للوصول...

Anti-Tamper-Perturbation

🛡️ الحماية من العبث ضد التوليد غير المصرح به للصور الفردية الكود الرسمي لورقة ICCV 2025 📄 الحماية من العبث ضد التوليد غير المصرح به للصور الفردية ⚙️ إعداد البيئة conda create --name ATP --file requirements.txt conda activate ATP 🔐 تشغيل ATP 1. قم بتنزيل مجموعتي البيانات CelebA-HQ وVGGFace2. يمكن...

CVE-2026-59357 - Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions | Cloud Foundry

Severity High CVSS score: 7.2 High CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Vendor Cloud Foundry Foundation Versions Affected Severity is High unless otherwise noted. UAA – Confirmed in UAA v4.5.0 to v79.6.0 inclusive Description Insufficient verification of data...

PT-2026-106082

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/project id/join/pk/ uses permission classes = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

ROS-20261005-73-0099

The vulnerability in dotnet9.0 is related to a lack of source verification mechanism. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

PT-2026-106241

Name of the Vulnerable Software and Affected Versions AMD Zynq™ UltraScale+ MPSoC affected versions not specified AMD RFSoC affected versions not specified Description Insufficient boundary validation in the USB boot mode implementation allows unbounded Device Firmware Upgrade DFU download reques...

ROS-20261005-73-0092

The vulnerability in dotnet10.0 is related to the lack of protection for service data. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

ROS-20261005-73-0101

The vulnerability in dotnet10.0 is related to a lack of source verification mechanism. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

Cryptanalysis of a Class of Ideal Secret Sharing Schemes Based on the CRT for Polynomial Rings

Based on the CRT for polynomial rings, Yang, Zhu, Fu and Xia ISIT 2026 proposed a compartmented secret sharing scheme for the compartmented access structure with lower bounds, claiming it can be ideal. We exhibit three families of unauthorized subsets that reconstruct the secret. The scheme is...

PT-2026-106200

Name of the Vulnerable Software and Affected Versions Ghost versions 5.9.0 through 6.44.0 Description An input validation issue in this Node.js content management system allows members to access comments for which they lack proper authorization. Recommendations Update to version 6.44.1...

CVE-2026-71299: Missing Authentication for Critical Function

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-105681: Improper Neutralization of Special Elements in Data Query Logic

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...