CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-49230-APISIX-jwe-decrypt-Auth-Bypass

CVE-2026-49230 — Apache APISIX jwe-decrypt Authentication Bypass Proof of concept for an authentication bypass in the Apache APISIX jwe-decrypt plugin. The plugin decrypts a JWE token and forwards its plaintext to the upstream, acting as an authentication gate — but it never validates the AES-GCM...

CVE-2026-50338

CVE-2026-50338 Omisión de autenticación entre emisores en el servidor de recursos de Spring Cloud Azure B2C Descripción AadB2cResourceServerAutoConfiguration en spring-cloud-azure-autoconfigure construye un JwtDecoder que confía en seis emisores de línea AAD login.microsoftonline.com,...

CVE-2026-49049

CVE-2026-49049 — Helix3 Joomla Plugin JoomShaper Unauthenticated AJAX Handler — Read-Only Vulnerability Scanner Overview CVE-2026-49049 affects the Helix3 template framework for Joomla versions 1.0 through 3.1.0. The onAjaxHelix3 handler, reachable via Joomla's comajax dispatcher, performs no...

CVE-2026-27626-POC

CVE-2026-27626: OliveTin password-argument command injection OliveTin lets an admin define "actions": shell commands with parameterized arguments that users can trigger from a web UI or API. Before templating a user-supplied value into the shell command, OliveTin is supposed to run it through...

asclepius

Asclepius Asclepius validates backup integrity by restoring files and actively testing their recoverability. Instead of trusting metadata, it attempts to parse real file formats documents, images, videos, archives, emails to confirm backups can actually be read and are safe to use. Installation...

CVE-2026-9198

CVE-2026-9198 - IBM Langflow Unauthenticated RCE via Auto-Login Bypass Educational PoC This repository provides an educational proof of concept for CVE-2026-9198 affecting IBM Langflow OSS. The PoC poc.py demonstrates how an unauthenticated attacker can chain: 1. GET/POST /api/v1/autologin return...

CVE-2025-65640

CVE-2025-65640 1. Vulnerability Information CVE ID: CVE-2025-65640 Currently RESERVED Vulnerability Type: Stored Cross-Site Scripting XSS CVSSv3 score: 6.3 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N Vendor: Arket/Bluenext S.r.l. Product: Globe Document Intelligence Affected Version: 5.0.0.559 Discoverer...

CVE-2026-3288

CVE-2026-3288: ingress-nginx Configuration Injection via rewrite-target Annotation Keywords: CVE-2026-3288, ingress-nginx vulnerability, Kubernetes security, nginx configuration injection, rewrite-target annotation, RCE, Secret disclosure, CWE-20, CAPEC-176, ingress-nginx CVE 2026, Kubernetes...

hibernate__hibernate-validator_CVE-2019-10219_6-0-17-Final

Hibernate Validator Version: 6.0.17.Final - 13-06-2019 What is it? This is the reference implementation of JSR-380 - Bean Validation 2.0. Bean Validation defines a metadata model and API for JavaBean as well as method validation. The default metadata source are annotations, with the ability to...

CVE-2026-81315

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2022-46364-Poc

CVE-2022-46364 Exploit Apache CXF SSRF via MTOM XOP:Include | CVSS 9.8 CRITICAL Vulnerability Apache CXF -s -d -t, --target - Vulnerable CXF SOAP endpoint required -s, --ssrf-url - Internal URL to exfiltrate required -d, --domain - Target domain default: localhost --plain-soap - Use plain SOAP...

wp2shell-scanner

wp2shell-scanner por@bahartanir katherinepierce Fork de ZephrFish/wp2shell-scanner con mejoras adicionales. Investigación por Adam Kues Assetnote y Mustafa Can İPEKÇİ nukedx. Herramienta de detección y validación para la exposición del núcleo de WordPress a wp2shell CVE-2026-63030 / CVE-2026-6013...

EUVD-2026-68304

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315

CVE-2026-81315 is an origin validation error in ash-project ash_ai (affecting AshAi.Mcp.Server), allowing a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server using that user's actor. The root cause lies in origin_allo...

CVE-2026-3891

CVE-2026-3891 Pix for WooCommerce = 1.5.0 - Unauthenticated Arbitrary File Upload 💣 Pix for WooCommerce = 1.5.0 – Unauthenticated Arbitrary File Upload CVE-2026-3891 👤 Nxploited 🧩 Description The Pix for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file upload due t...

CVE-2026-63223-POC

CVE-2026-63223 PoC — RCE mediante subida de archivos en CodeIgniter 4 CVSS 9.8 Crítico | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-434 : Subida sin restricciones de un archivo con tipo peligroso Corregido : CodeIgniter 4 v4.7.4 Aviso : GHSA-mmj4-63m4-r6h5 Resumen de la vulnerabilidad Las reglas de...

CVE-2020-10567

POC-CVE-2020-10567 RCE poc - RESPONSIVE filemanager v.9.14.0. not Main branche ⚠️ Github project : https://github.com/trippo/ResponsiveFilemanager Requirements: Nothing is required, this exploit is unauthenticated. The Responsive Filemanager application is a web-based file management tool used to...

Important: freerdp

Issue Overview: FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands...