oak
project-oak/oakMeaningful control of data in distributed systems.
authenticationcloud-infrastructure-securitycontainer-security+7
project-oak/oakMeaningful control of data in distributed systems.
abraxas/spark-rest-auth-bypassApache Spark 4.2.0 - High - Remote - Privilege leftover - standalone REST ignores spark.authenticate
abraxas/uptime-kuma-setup-toctouProof-of-concept for a TOCTOU race in Uptime Kuma's first-run Socket.IO setup, letting an unauthenticated attacker plant a hidden second admin and…
abraxas/sonic-gnmi-noauthDocuments and reproduces a fail-open authentication flaw in SONiC gNMI where an empty UserAuth map allows unauthenticated gNMI Set and gNOI writes,…
abraxas/vaultwarden-ip-header-spoofVaultwarden 1.37.3 default X-Real-IP trusted-local bypasses login rate limits on Docker NAT
abraxas/element-fragment-guestElement Web v1.12.29 - High - Remote - Session - fragment guest creds wipe a real session before whoami
abraxas/cve-2026-59358Proof-of-concept lab and exploit client for CVE-2026-59358, demonstrating Cloud Foundry UAA reuse of a user PKCE token as client_credentials Bearer…
abraxas/cve-2026-103956-loom-unauthCVE-2026-103956 - Loom for AWS - Critical - Auth bypass - unauthenticated super-admin when no IdP is configured
murrez/cve-2026-100835Python PoC for CVE-2026-100835: audits Contrast manifests for AllowedChipIDs/AllowedPIIDs, detects versions, and probes Coordinator endpoints to…
yym8538/cve-2026-20896Proof-of-concept lab and Python/cURL scripts demonstrating CVE-2026-20896, an authentication bypass in official Gitea Docker images via the…
yym8538/cve-2026-25253Proof-of-concept exploit for CVE-2026-25253 in OpenClaw: a crafted gatewayUrl exfiltrates the Control UI gateway token, enabling unauthorized gateway…
eqstlab/cve-2026-49869PoC and Docker lab for CVE-2026-49869, an unauthenticated RCE in Kestra OSS via an AuthenticationFilter path bypass that allows flow creation and…
abraxas/cve-2026-5430Disclosure pack and Python PoC for CVE-2026-5430, a JWT algorithm-confusion flaw in WSO2 API Manager 4.5.0 enabling unauthenticated admin account…
pwnvader/cve-2026-88877-poc-pwnvaderProof-of-concept and reproducible lab for CVE-2026-88877, a Traefik ingress-nginx authentication bypass via from-to-www-redirect, with a read-only…
polosss/by-poloss..-..cve-2026-19125Verified proof-of-concept exploiting the EthPress <= 2.3.5 unauthenticated authentication bypass, granting a WordPress administrator session via a…
chandrimanath04-hue/cve-2024-31218-webhood-labDocker-based lab reproducing CVE-2024-31218, an unauthenticated PocketBase admin creation flaw in Webhood, with PoC, detection, and remediation…
abraxas/cve-2026-13447Proof-of-concept exploit for CVE-2026-13447, a critical authentication bypass in the WordPress MStore API plugin via forged Firebase JWT tokens, with…
abraxas/cve-2026-75816Proof-of-concept and lab reproduction for CVE-2026-75816, an unauthenticated WordPress Frontend Admin account takeover via admin-ajax form submission.