147 matches found
CVE-2025-34300POC
Sawtooth Lighthouse Studio weist eine Vorlageninjektions-Schwachstelle auf CVE-2025-34300 Parameter: root@kitploit: options: -h, --help show this help message and exit -u URL, --url URL 请输入待检测的URL -f FILE, --file FILE 请输入一行一个URL的文件地址 Beispiele: root@kitploit: Einzeltest: python...
CVE-2026-79053
CVE-2026-79053 is a missing authorization flaw in the Lighthouse component of Google Chrome prior to version 152.0.7977.65 . A remote attacker who had already compromised the renderer process and leveraged social engineering could use a crafted HTML page to bypass site isolation , a key security ...
SawtoothSoftware Lighthouse Studio < 9.16.14 - Pre-Auth Remote Code Execution
A pre-authentication remote code execution vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14. The issue arises from the unsafe use of the eval function within the Perl CGI component ciwweb.pl, where attacker-supplied input inside hidRandomACARAT is directly...
lightkeeper
lightkeeper Ein Port des Lighthouse-Plugins für GHIDRA. Icons erstellt von Pixel perfect von www.flaticon.com...
CVE-2026-66788 Lighthouse: lighthouse: arbitrary local-namespace injection via attacker-controlled labelsourcenamespace
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...
CVE-2026-66788
CVE-2026-66788 is a critical (CVSS 9.9) vulnerability in Lighthouse , a Kubernetes multi-cluster service mesh component. The root cause is that the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. An attacker who comprom...
EUVD-2026-63535
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...
CVE-2026-66787
In Red Hat Advanced Cluster Management for Kubernetes, the lighthouse component fails to validate IP addresses in EndpointSlice objects. A compromised spoke cluster can publish attacker-controlled IPs, causing other clusters' lighthouse DNS to resolve legitimate cross-cluster service names to mal...
EUVD-2026-63533
A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...
CVE-2026-66787 Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice and serviceimport ips
A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...
CVE-2026-66788
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...
CVE-2026-66787
A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...
CVE-2026-73264
Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated baseurl for the openaicompatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...
CVE-2026-73264 Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider
Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated baseurl for the openaicompatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...
CVE-2026-73264
Prowler (cloud security platform) contains an SSRF risk prior to version 5.33.1. An authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider via POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/...
PT-2026-71085
Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base url for the openai compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...
CVE-2025-58902
Unauthenticated Local File Inclusion in Lighthouse = 1.2.12 versions...
CVE-2025-58902
CVE-2025-58902 affects the WordPress Lighthouse theme (versions <= 1.2.12). It is an unauthenticated Local File Inclusion (LFI) vulnerability in Lighthouse
