access control bypass

ProFTPD ACL Bypass Flaw Exposes Files in Restricted Directories

• Vulnerability Report

ProFTPD ACL Bypass Flaw Exposes Files in Restricted Directories

Do Son July 1, 2026 0

A ProFTPD ACL bypass (CVE-2026-35025, CVSS 8.6) lets logged-in FTP users reach files in restricted directories. No patch is out yet; use DefaultRoot.

Triple CVSS 10.0 Warning: Critical Ubiquiti UniFi OS Flaws Allow Unauthenticated Remote Takeovers

• Vulnerability Report

Triple CVSS 10.0 Warning: Critical Ubiquiti UniFi OS Flaws Allow Unauthenticated Remote Takeovers

Do Son May 22, 2026 0

Ubiquiti patches three critical CVSS 10.0 vulnerabilities in UniFi OS affecting gateways, storage, and NVRs. Update your firmware immediately!

Splunk Patches High-Severity Bugs Granting DoS and Internal Log Leaks

• Vulnerability Report

Splunk Patches High-Severity Bugs Granting DoS and Internal Log Leaks

Do Son May 22, 2026 0

Splunk releases coordinated patches for CVE-2026-20240 and adjacent flaws exposing raw session cookies, data filters, and triggering server DoS.

Critical Spring AI Flaws Expose Databases to SQL and JSONPath Injection

• Vulnerability Report

Critical Spring AI Flaws Expose Databases to SQL and JSONPath Injection

Do Son March 17, 2026 0

Two critical flaws in Spring AI (CVE-2026-22729 & CVE-2026-22730) allow attackers to bypass access controls via JSONPath and SQL injection. Update now.

Major Security Overhaul for Apache Superset: Five Vulnerabilities Patched

• Vulnerability Report

Major Security Overhaul for Apache Superset: Five Vulnerabilities Patched

Do Son February 26, 2026 0

Apache Superset 6.0.0 addresses high-severity flaws, including a PostgreSQL read-only bypass and dataset access control leaks. Secure your BI platform today!

“Better Auth” Framework Alert: The Double-Slash Trick That Bypasses Security Controls

• Vulnerability Report

“Better Auth” Framework Alert: The Double-Slash Trick That Bypasses Security Controls

Do Son December 18, 2025 0

A normalization flaw in Better Auth's router allows attackers to bypass access controls and rate limits using simple double-slash URLs.

Multi Flaws Found in HikCentral, Including a Bypass for Admin Access (CVE-2025-39247)

• Vulnerability Report

Multi Flaws Found in HikCentral, Including a Bypass for Admin Access (CVE-2025-39247)

Do Son August 29, 2025 0

Hikvision has issued an advisory for three flaws in its HikCentral products. The most severe, with a CVSS of 8.6, allows an unauthenticated user to get admin access.

Apache Traffic Server Flaws Allow Access Bypass & Remote DoS

• Vulnerability

Apache Traffic Server Flaws Allow Access Bypass & Remote DoS

Do Son June 19, 2025 0

Two critical flaws in Apache Traffic Server (CVE-2025-31698, CVE-2025-49763) allow IP-based ACL bypass and remote DoS via ESI plugin.

Critical NetScaler Flaws Allow Access Control Bypass & Memory Overread

• Vulnerability Report

Critical NetScaler Flaws Allow Access Control Bypass & Memory Overread

Do Son June 18, 2025 0

Cloud Software Group issues urgent patches for two critical NetScaler flaws allowing access bypass and memory overread. Update immediately.

Critical Flaw in Fabio Load Balancer Allows HTTP Header Tampering & Access Bypass

• Vulnerability

Critical Flaw in Fabio Load Balancer Allows HTTP Header Tampering & Access Bypass

Do Son June 2, 2025 0

A critical flaw in Fabio load balancer allows malicious clients to manipulate or strip HTTP headers, leading to potential access control bypass. Upgrade to 1.6.6.