CVE-2026-77180

creationtimestamp| type| source ---|---|--- 2026-09-03 08:45:16+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=2047 2026-09-03 12:45:06+00:00| seen| https://www.acn.gov.it/portale/w/f5-risolte-vulnerabilita-nei-prodotti-nginx 2026-09-03 13:45:08+00:00| seen|...

CVE-2026-63020

creationtimestamp| type| source ---|---|--- 2026-09-03 08:45:05+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=2047 2026-09-03 13:45:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mumli32zq72z...

kong

Kong: 自主逆向工程师 用于逆向工程二进制文件的LLM编排 Kong是什么？ 大多数任务遵循线性关系：任务越难，通常耗时越长。逆向工程（及二进制分析）是一种任务，其实际难度其实并不高，但执行时间却可能长达数小时甚至数天，即使是只有几百个函数的二进制文件也是如此。 Kong 使用NSA级别的逆向工程框架，将机械层自动化。Kong 可以接收一个完全混淆且剥离了符号的二进制文件，运行完整的分析管线：对函数进行分类、构建调用图上下文、通过LLM引导的反编译恢复类型和符号，并将结果写回 Ghidra 的程序数据库。输出的二进制文件中，某个 FUN00401a30 变成了...

cve-2014-6271-mengjia-kong

此存储库没有 README。...

Kong Admin <=2.03 - Admin API Access

Kong Admin through 2.0.3 contains an issue via docker-kong which makes the admin API port accessible on interfaces other than 127.0.0.1. id: CVE-2020-11710 info: name: Kong Admin =2.03 - Admin API Access author: pikpikcu severity: critical description: Kong Admin through 2.0.3 contains an issue v...

kong-pwn

kong-pwn Usa la KongAPI esposta per agire come un proxy e ottenere URL di metadata o URL interni. CVE-2020-11710 - Non è una vulnerabilità, è una errata configurazione. Come usarlo root@kitploit: usage: kong-pwn.py -h -u URL -s SSRF -p PROXY kong-pwn.py: error: the following arguments are require...

CVE-2026-18674

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

EUVD-2026-60160

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674

Kong Mesh multi-zone deployments are vulnerable in the zone-to-global KDS sync: the global control plane trusts an in-band, sender-controlled ControlPlane.Identifier instead of the authenticated TLS zone identity. This allows any authenticated zone to inject, attribute, and overwrite resources in...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18677

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

CVE-2026-18676

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

CVE-2026-18679 Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...

CVE-2026-18679

CVE-2026-18679 : Kong Mesh kuma-dp connects to the control plane over TLS without certificate verification when no CA is configured. This disables TLS peer verification for the data plane and sends the dataplane authentication token over the unverified channel. An on-path attacker can intercept t...

CVE-2026-18679 Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...

CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

CVE-2026-18678

The CVE affects Kong Mesh/Kuma’s kumactl when adding an HTTPS control-plane profile without a CA certificate. The root cause is that kumactl disables TLS verification and sends API tokens over an unverified connection. This allows an attacker on the network path between the operator and the contr...

CVE-2026-18677

In Kong Mesh (universal mode), the XDS authenticator in kuma-cp validates the dataplane’s SPIFFE ID path template against the kuma.io/workload label only when the dataplane token is bound to a workload. Because workload binding is optional, a dataplane presenting a tags-bound token can register w...