MassDriver

MassDriver 셸코드에서 아티팩트로 민감한 API 호출을 프록시하여 CET 호환의 깨끗한 콜 스택을 구현합니다. 제 블로그 포스트의 동반 PoC: Stop Being Weird — Life After Call Stack Spoofing Under CET 빌드 MinGW에는 CET 호환 플래그를 설정할 방법이 없으므로 CET로 빌드하려면 llvm-mingw가 필요합니다. 기본적으로 ./payload/testDll.c를 페이로드로 사용하여 빌드하며, 이 페이로드는 LoadLibraryA와 Sleep을 호출하므로 콜 스택을 검...

CVE-2026-33340

CVE-2026-33340: lollms-webui의 SSRF 취약점 개요 필드| 세부 정보 ---|--- CVE ID| CVE-2026-33340 취약점| 서버 측 요청 위조 SSRF 영향받는 제품| ParisNeo/lollms-webui LoLLMs WEBUI 심각도| Critical — CVSS 9.1 CVSS 벡터| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-918: 서버 측 요청 위조 SSRF 영향받는 구성 요소|...

CVE-2026-90448 Missing Authorization in Malcolm

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifie...

CVE-2026-90448 Missing Authorization in Malcolm

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifie...

PT-2026-90516

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A deployment mode designed to provide read-only access to stored data fails to restrict request methods on certain application programming interface routes. This...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843

OpenChoreo is vulnerable prior to versions 1.0.2 and 1.1.2 due to unauthenticated access in internal/cluster-gateway/server.go that exposed caller-facing management APIs on the external agent listener. This allows network-reachable attackers to invoke /api/proxy/ and /api/exec/, proxy the data-pl...

CVE-2026-19374: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The...

CVE-2026-54157

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make...

Missing Authentication For Critical Function

github.com/tilt-dev/tilt is vulnerable to Missing Authentication for Critical Function. The vulnerability is due to the Tilt HUD HTTP server registering handlers without authentication middleware when bound to a non-loopback address, which allows an unauthenticated attacker to trigger...

CVE-2026-2264

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery SSRF and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API...

The vulnerability of the API proxy server of the data source platform for Grafana’s monitoring and observation allows a malicious actor to gain unauthorized access to read the GET endpoints in the Alertmanager and Prometheus data sources.

The vulnerability of the API proxy server of the data source platform for Grafana relates to authentication errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read GET requests directed at the final endpoints in the Alertmanager and...

CVE-2026-2264 Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery SSRF and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API...

EUVD-2026-31865

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery SSRF and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API...

Portainer missing authorization on Docker plugin endpoints, which allows host RCE

Summary Portainer enforces Role-Based Access Control RBAC on top of the Docker API. The proxy layer routes incoming Docker API requests to per-resource handlers containers, images, services, volumes, etc. that apply authorization checks. The Docker plugin management endpoints /plugins/ were not...

RHCOS 3 : Red Hat OpenShift Enterprise 3.1 (RHSA-2016:1095)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1095 advisory. - 3: Untrusted content loaded via the API proxy can access web console credentials on the same domain CVE-2016-3703 Note that Nessus has not...

RHCOS 3 : Red Hat OpenShift Enterprise 3.2 (RHSA-2016:1094)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1094 advisory. - 3: Untrusted content loaded via the API proxy can access web console credentials on the same domain CVE-2016-3703 - 3: s2i builds...

Copilot API Proxy 安全漏洞

Copilot API Proxy is a reverse proxy service for the GitHub Copilot API developed by Erick Christian. Versions of Copilot API Proxy prior to 0.7.0 contain security vulnerabilities. These vulnerabilities stem from the Header Handler component’s reliance on reverse DNS resolution for handling Host...

Copilot API Proxy 安全漏洞

Copilot API Proxy is a reverse proxy service for the GitHub Copilot API developed by Erick Christian. Versions of Copilot API Proxy prior to 0.7.0 contain security vulnerabilities. These vulnerabilities stem from a flaw in the cors function within the file/src/server.ts file of the component’s...

EUVD-2026-20625

A security flaw has been discovered in bigsk1 openai-realtime-ui up to 188ccde27fdf3d8fab8da81f3893468f53b2797c. The affected element is an unknown function of the file server.js of the component API Proxy Endpoint. Performing a manipulation of the argument Query results in server-side request...