1907 matches found
PoC-in-GitHub
PoC in GitHub 2026 CVE-2026-0006 2026-03-02 In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...
cve-2026-0013-poc
CVE-2026-0013 Android DocumentsUI Confused Deputy Vulnerability - Security Research Verification Project Important Notice This repository is a derived build repository, affiliated with the original upstream repository. Role| Repository| Description ---|---|--- Main repository|...
StrandHogg2
StrandHogg2 Poc for StrandHogg2 CVE-2020-0096 Information of the original vulnerability Current Description In startActivities of ActivityStartController.java, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege with no additional...
CVE-2026-20516
CVE-2026-20516: MiracastService confused deputy on Android TV Research and disclosure by Davide Di Matteo @Dingo97. This is my first credited CVE. I found an improperly exported, system-privileged Miracast service while researching a PEAQ Android TV. A caller can supply an intent extra that makes...
CVE-2026-49086
camel-dapr Consumer Routing-Header Override / Confused Deputy Reproducer CVE-2026-49086 This project demonstrates a routing-header override confused-deputy flaw in Apache Camel's camel-dapr component, tracked as CVE-2026-49086. The Dapr pub/sub consumer DaprPubSubConsumer copies fields of the...
CVE-2026-64640
CVE-2026-64640 — Apache Polaris: credential vending before location validation in register A self-contained, one-command reproducer for CVE-2026-64640 : the Iceberg REST register endpoints in Apache Polaris mint cloud storage credentials for a caller-supplied path and read that path server-side...
Chromium CVE-2026-106266: Confused deputy
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-106228: Confused deputy
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-106286: Confused deputy
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-106188: Confused deputy
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-106359: Confused deputy
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-106301: Confused deputy
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Astra Linux – Vulnerability in Chromium
The confused deputy in Fullscreen mode in Google Chrome before version 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and used social engineering to spoof UI elements through a crafted HTML page. Chromium security severity: Low...
CVE-2026-53999
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...
CVE-2026-53999 Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...
CVE-2026-53999
The Radius Kubernetes controller (versions 0.57.1 and earlier) is vulnerable to a Confused Deputy attack due to improper input validation in the deserialization of the radapp.io/status annotation on Kubernetes Deployments. The controller fails to verify if the resource IDs provided in this user-c...
EUVD-2026-101606
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...
CVE-2026-53999
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...
CVE-2026-53999 Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...
