POC_CVE-2026-46716

CVE-2026-46716 — Nezha Monitoring Cross-Tenant RCE via Cron API Authorization Bypass A lab environment for reproducing and detecting CVE-2026-46716 , a critical vulnerability in Nezha Monitoring where the POST /api/v1/cron endpoint lacks admin privilege checks, allowing RoleMember users to achiev...

CVE-2025-34159

CVE-2025-34159: Docker Compose Injection in Coolify Vulnerability Overview Field| Value ---|--- CVE ID| CVE-2025-34159 Affects| Coolify ≤ v4.0.0-beta.420.6 Fixed in| v4.0.0-beta.420.7 Severity| Critical CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE| CWE-78 OS Comma...

CVE-2021-1056

CVE-2021-1056 CVE-2021-1056 is a vulnerability I submitted to NVIDIA PSIRT. Personally, it may lead to high security risks in multi-tenant HPC clusters, especially in cloud machine-learning platforms. This repository simply demonstrates the vulnerability on GPU containers created by...

kata-containers

Kata Containers Welcome to Kata Containers! This repository is the home of the Kata Containers code for the 2.0 and newer releases. If you want to learn about Kata Containers, visit the main Kata Containers website. Introduction Kata Containers is an open source project and community working to...

jiopc-architecture-whitepaper

Architecture, Performance, and Security Analysis of JioPC Cloud Virtual Desktops A Comprehensive Technical Whitepaper & Engineering Evaluation Document Version : 2.0 Target Platform : JioPC Cloud Virtual Desktop Accops HyWorks / Microsoft Azure Classification : Technical Evaluation &...

loki

Loki: like Prometheus, but for logs. Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus. It is designed to be very cost effective and easy to operate. It does not index the contents of the logs, but rather a set of labels for each log...

agentZ

Zero Trust Agentic AI Platform Build, run, and govern AI agents. Secure by design. Every agent runs inside a default-deny sandbox and never receives a credential. Every agent action is traceable. AgentZ is a multi-tenant platform for running AI agents. It provides strong isolation guarantees, zer...

GHSA-4V6F-7VJH-6X4M Strands Agents SDK: Exposure of data element to wrong session in the A2A Server

Summary Strands Agents SDK is an open-source SDK, available for Python strands-agents and TypeScript @strands-agents/sdk, for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent A2A server shares conversation history across callers with different...

GHSA-84C9-QQPQ-2PQ5 obsidian-tc tokens can access arbitrary configured vaults

Impact Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault ctx.vaultId; the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault,...

obsidian-tc tokens can access arbitrary configured vaults

Impact Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault ctx.vaultId; the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault,...

CVE-2026-23552

CVE-2026-23552 - Cross-Realm Token Acceptance in camel-keycloak Overview Apache Camel's KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. This means a token issued by one Keycloak realm is silently accepted by a policy configured for a...

cloudfoundry_uaa

CloudFoundry User Account and Authentication UAA Server The UAA is a multi tenant identity management service, used in Cloud Foundry, but also available as a stand alone OAuth2 server. It's primary role is as an OAuth2 provider, issuing tokens for client applications to use when they act on behal...

CVE-2026-115332

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscriptionfilterkeys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted...

CVE-2026-115330

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

EUVD-2026-108134

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscriptionfilterkeys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted...

CVE-2026-115330 Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

EUVD-2026-108132

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

CVE-2026-115330

Lotus versions up to and including 0.10.2 are vulnerable to an SQL injection vulnerability. Authenticated organization users can execute arbitrary SQL by submitting semicolon-separated stacked statements via POST /app/metrics/ . This method bypasses first-statement-only validation, potentially al...

CVE-2026-111386 Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denie...

CVE-2026-110775

Nexent versions up to and including 2.7.0 are vulnerable to a missing authorization flaw within the check_file_access function. The root cause is the failure to perform tenant comparisons during knowledge_base/ reads, which allows authenticated users in multi-tenant environments to access data be...