Tag
IBM Langflow OSS Improper Authentication Vulnerability
2 rules 5 TTPs 3 CVEsA remote attacker can gain full administrative access to IBM Langflow OSS versions 1.0.0 through 1.10.0 by exploiting an improper authentication vulnerability. The /api/v1/login/auto_login endpoint, when the default AUTO_LOGIN configuration is enabled, issues long-lived superuser bearer tokens without requiring authentication. This allows an unauthenticated network attacker to obtain these tokens and achieve superuser privileges. Additionally, permissive Cross-Origin Resource Sharing (CORS) settings could expose these tokens to unintended origins, exacerbating the risk.
PraisonAI web_crawl Tool Vulnerable to DNS Rebinding SSRF (CVE-2026-61430)
1 rule 3 TTPs 1 CVEPraisonAI versions prior to 1.6.78 are vulnerable to server-side request forgery (SSRF) within its web_crawl tool, allowing attackers to bypass hostname validation using DNS rebinding and retrieve sensitive internal HTTP response bodies from private or loopback services.
CVE-2026-10167 Improper Authentication in OUSL-GROUP-BrinaryBrains School Student Management System
2 rules 1 TTP 1 CVECVE-2026-10167 is an improper authentication vulnerability in OUSL-GROUP-BrinaryBrains School Student Management System allowing a remote attacker to manipulate the 'role' argument to bypass authentication.
WWBN AVideo Unauthenticated decryptString Vulnerability
2 rules 1 TTPWWBN AVideo, up to version 26.0, contains an improper authentication vulnerability (CVE-2026-33512) in the API plugin's `decryptString` action, allowing unauthenticated users to decrypt publicly accessible ciphertext and potentially recover protected tokens/metadata.