880 matches found
CVE-2026-117681
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority...
EUVD-2026-114682
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority...
CVE-2026-117681 Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority...
openclaw-hardening-check
This script only reads. It fixes nothing and does not guarantee that you are safe. Green output means only that the checks listed below passed—and nothing more. OpenClaw hardening check openclaw-hardening-check.mjs is a small, dependency-free, offline review of an OpenClaw installation. It reads...
CVE-2024-25175
CVE-2024-25175 Reflected XSS via HTTP Response Splitting Description : Exploitation of this vulnerability can lead to the execution of JavaScript code in the victim's browser Cross-Site Scripting when following a specially crafted link. The vulnerability arises because The web server does not...
CVE-2026-117681: A flaw was found in konflux-ci
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority...
PT-2026-134488
Name of the Vulnerable Software and Affected Versions konflux-ci affected versions not specified Description A flaw in the user interface proxy allows privilege escalation when Transport Layer Security TLS certificate verification is automatically disabled for connections to internal backend...
CVE-2026-25253
CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw 1-Click Remote Code Execution PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e Description CVE-2026-25253 : OpenClaw Authentication Token Exfiltration Vulnerability description: OpenClaw aka clawdbo...
CVE-2026-48164
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the hostsessionid query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding...
EUVD-2026-114089
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the hostsessionid query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding...
CVE-2026-48164 Collabora Online: Reflected HTML injection through host_session_id
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the hostsessionid query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding...
PT-2026-133658
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the host session id query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding...
CVE-2026-48164: CollaboraOnline online: Collabora Online is a collaborative online office suite based on LibreOffice technology
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the hostsessionid query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding...
EUVD-2026-111132
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a...
Nextcloud Whiteboard server request forgery vulnerability
Versions prior to Nextcloud Whiteboard 1.0.0 contain a server-side request forgery vulnerability. This vulnerability arises from the ability to access the internal Chrome DevTools Protocol API, which can be used to expose another user’s JWT authentication token. Low-privilege attackers can exploi...
CVE-2026-87897: Server-Side Request Forgery (SSRF)
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a...
Django REST Framework: TokenProxy.delete() Reports Success And Revokes Nothing
Summary Deleting an authentication token through "TokenProxy" silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling...
storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token
A flaw was found in Storybook, which may lead to arbitrary code execution. The development server exposes its WebSocket authentication token to clients loading its web pages across a local area network LAN. An attacker on the local network can capture this token and abuse file-writing functionali...
storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token
A flaw was found in Storybook, which may lead to arbitrary code execution. The development server exposes its WebSocket authentication token to clients loading its web pages across a local area network LAN. An attacker on the local network can capture this token and abuse file-writing functionali...
storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token
A flaw was found in Storybook, which may lead to arbitrary code execution. The development server exposes its WebSocket authentication token to clients loading its web pages across a local area network LAN. An attacker on the local network can capture this token and abuse file-writing functionali...