1dayexploit

CVE-2026-16639: Drupal i18n_sso Auth Bypass

Sat, 29 Aug 2026 14:30:00 GMT

CVE-2026-16639: Drupal Internationalization Single Sign-On authentication bypass via SQL LIKE wildcard injection and predictable token generation (CVSS 9.8)

CVE-2026-68525: Apache Tomcat - Auth Bypass

Sat, 29 Aug 2026 14:30:00 GMT

Authorization bypass in Apache Tomcat FORM authentication allows low-privilege users to execute POST requests restricted to admin roles by exploiting a method-rewrite bug in saved request restoration.

CVE-2026-77998: miniOrange SAML - Joomla Auth Bypass

Thu, 27 Aug 2026 10:00:00 GMT

CVE-2026-77998: miniOrange SAML SSO for Joomla authentication bypass via improper tri-state signature verification. Unauthenticated attackers can log in as any existing user.

CVE-2026-10053: GitLab npm Path Traversal RCE

Tue, 25 Aug 2026 14:30:00 GMT

CVE-2026-10053 (CVSS 8.5): GitLab npm registry path traversal allows authenticated arbitrary file write and RCE via package poisoning on consumers.

CVE-2026-18963: Keycloak - Auth Bypass

Tue, 25 Aug 2026 08:30:00 GMT

CVE-2026-18963: Keycloak unauthenticated account takeover via reset-credentials flow - attacker sets arbitrary password without email verification, CVSS 9.1 critical.

CVE-2026-77647: SPIP Pre-Auth RCE

Mon, 24 Aug 2026 10:15:00 GMT

CVE-2026-77647 is a pre-authentication remote code execution in SPIP before 4.4.20. A regex-based template compiler flaw combined with raw var_export() allows unauthenticated attackers to inject arbitrary PHP code.

CVE-2026-55674: Discourse Cache Poisoning XSS

Fri, 21 Aug 2026 14:30:00 GMT

Discourse 3.5.0-beta2 through 2026.1.5 allows unauthenticated XSS via color scheme cookies that bypass CSP and poison the anonymous cache to all visitors. CVSS 9.3 critical.

CVE-2026-19478: GitLab GraphQL Auth Bypass

Fri, 21 Aug 2026 02:15:00 GMT

CVE-2026-19478: Unauthenticated GitLab authorization bypass via GraphQL @gl_introduced directive, allowing arbitrary method invocation on public projects. CRITICAL.

CVE-2026-75143: FFmpeg RIST Heap OOB Write

Thu, 20 Aug 2026 13:35:00 GMT

FFmpeg CVE-2026-75143: RIST protocol reader heap buffer overflow, remote unauthenticated DoS via oversized payload in async:rist:// receiver

CVE-2026-18051: W3 Total Cache - Arbitrary File Write

Thu, 20 Aug 2026 13:00:00 GMT

CVE-2026-18051 is a critical unauthenticated path traversal vulnerability in W3 Total Cache before 2.10.5, allowing arbitrary file writes to any existing directory on the server via the Disk Enhanced page cache.

CVE-2026-18366: Events Manager - Privilege Escalation

Thu, 20 Aug 2026 12:00:00 GMT

CVE-2026-18366: Events Manager < 7.4.1 allows unauthenticated privilege escalation to Administrator through broken access control - full site takeover.

CVE-2026-47686: vm2 Sandbox Escape - RCE

Thu, 20 Aug 2026 12:00:00 GMT

CVE-2026-47686: vm2 Node.js sandbox vulnerable to escape via unsanitized Error.cause, allowing arbitrary code execution as the host process user.

CVE-2021-20295: QEMU SLiRP IPv6 OOB Read

Wed, 19 Aug 2026 18:30:00 GMT

CVE-2021-20295: QEMU SLiRP trusts the guest IPv6 payload-length field, leaking up to 1.5 KB of hypervisor heap per ICMPv6 echo request. Information disclosure affecting QEMU 2.6.0-5.0.x.

CVE-2026-42945: NGINX Rift - Heap Buffer Overflow

Wed, 19 Aug 2026 14:50:00 GMT

NGINX Rift (CVE-2026-42945): Heap buffer overflow in the rewrite module causes unauthenticated remote worker crash and denial of service.

CVE-2026-15571: Keycloak Account Linking Auth Bypass

Wed, 19 Aug 2026 11:39:32 GMT

CVE-2026-15571: Keycloak forgeable account-linking hash enables OIDC clients to bind external identities and achieve full account takeover via auth bypass.

CVE-2026-19598: Pods Auth Bypass - Privilege Escalation

Mon, 17 Aug 2026 14:30:00 GMT

CVE-2026-19598: Unauthenticated auth bypass in Pods WordPress plugin leading to administrator privilege escalation. Critical CVSS 9.8.

CVE-2026-56654: Gitea - Access Token Scope Escalation

Mon, 17 Aug 2026 14:30:00 GMT

CVE-2026-56654: Gitea access token scope escalation (privilege escalation). A write:user token escalates to admin scope without a password.

CVE-2026-28185: Login with Google Auth Bypass

Mon, 17 Aug 2026 14:00:00 GMT

CVE-2026-28185: WordPress Login with Google auth bypass - unauthenticated administrator takeover via unverified email verification flag ignored in plugin <= 1.4.2.

CVE-2019-10349: Jenkins Dependency Graph - Stored XSS

Sat, 15 Aug 2026 15:30:00 GMT

Stored XSS (CVE-2019-10349) in Jenkins Dependency Graph Viewer Plugin <= 0.13 lets attackers inject arbitrary JavaScript via unescaped job Display Names.

CVE-2026-34486: Tomcat Tribes RCE

Sat, 15 Aug 2026 14:30:00 GMT

CVE-2026-34486 - Tomcat 10.1.53 RCE via EncryptInterceptor bypass in Tribes receiver. Unfiltered Java deserialization without authentication or credentials.