NGINX_2026_CVE_Bundle_CTI_Report

🛡️ NGINX 2026 Multi-CVE CTI Investigation CVE-2026-28755 • CVE-2026-42926 • CVE-2026-9256 • CVE-2026-42055 • CVE-2026-42533 Created by Pratik Chhetri Report Date: 2026-07-28 📌 Executive Snapshot CVE| Component| Primary Issue| Fixed Open Source Versions| Priority ---|---|---|---|--- CVE-2026-28755|...

Loom for AWS < 1.6.1 - Unauthenticated Super-Admin Access

Loom for AWS 1.6.1 contains a broken authentication caused by missing authentication for critical functions in the authentication dependency, letting remote actors obtain super-admin authority over the agent control plane, exploit requires no identity provider configured. id: CVE-2026-103956 info...

Nuclei-Template-CVE-2022-1388-BIG-IP-iControl-REST-Exposed

Nuclei Template CVE-2022-1388 BIG-IP iControl REST Exposed May 06, 2022 This only verifies the presence of the API by hitting the authentication endpoint This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP...

agentic-dm-gateway

Agentic DM Gateway Security control plane for LLM agents over private chat typically Discord DMs. It sits in front of your agent. It decides who may talk, whether the session is unlocked, whether the process is paused, and whether this message is safe enough to forward. Your model and tools stay...

day08-CISCO-fmc-sim

Day08 — Cisco FMC-style Management RCE Simulation This is a minimal, educational simulation that demonstrates the impact class of a management-plane parsing RCE inspired by CVE-2025-20265. It intentionally executes commands from crafted input for local learning only. Quickstart chmod +x...

Platypus

Platypus A host management hub for fleets of Linux machines. Install the Platypus agent on every host you own; the agent dials back to your Platypus server over TLS + protobuf; from the server you get an interactive shell, file management, and network tunnelling on every managed host — through on...

sdnpwn

What is sdnpwn? sdnpwn is a toolkit and framework for testing the security of Software-Defined Networks SDNs. For more information check out this article: https://sdnpwn.net/2017/08/22/what-is-sdnpwn/ Installation First download sdnpwn using git git clone https://github.com/smythtech/sdnpwn Make...

CVE-2026-20127

🛡️ CVE-2026-20127 — Cisco Catalyst SD-WAN Authentication Bypass 📌 Overview CVE-2026-20127 is a critical authentication bypass vulnerability affecting Cisco Catalyst SD-WAN components, including controllers and management systems. A remote unauthenticated attacker can exploit improper authenticatio...

DELTA

DELTA: SDN SECURITY EVALUATION FRAMEWORK What is DELTA? DELTA is a penetration testing framework that regenerates known attack scenarios for diverse test cases. This framework also provides the capability of discovering unknown security problems in SDN by employing a fuzzing technique...

CVE-2022-1388

CVE-2022-1388 BIG-IP iControl REST vulnerability CVE-2022-1388 This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services...

OpenClawMachines

OpenClaw Machines Run as many isolated OpenClaw agents as you need, on hardware you own. OpenClaw Machines is an open-source platform for runningOpenClaw in secure AI sandboxes on your own infrastructure. A control plane orchestrates your hosts, and each agent runs in its own Firecracker microVM ...

CVE-2020-5902

CVE-2020-5902 F5 BIG-IP Traffic Management User Interface TMUI Remote Code Execution In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has a Remote...

CVE-2026-103391

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length...

CVE-2026-46558

CVE-2026-46558 Plane’s V2 asset subsystem trusted workspace slugs and asset UUIDs without enforcing the right membership checks, which let one authenticated user read, copy, delete, and overwrite assets in other workspaces. Intro I found this issue while reviewing Plane , the open-source project...

EUVD-2026-112226

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length...

CVE-2026-103391

A vulnerability exists in the SSR TCP proxy/optimization path of the Juniper Networks Session Smart Router . An attacker can trigger an Out-of-bounds Write (CWE-787) by sending a transit TCP packet with a crafted TCP option length . This flaw allows for the corruption of forwarded packet data and...

CVE-2026-103391 Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length...

owasp-ctf-in-a-box

OWASP CTF in a Box A self-hosted control plane for security-learning events — one box, one free GitHub org. Run it for a university, a high school, an OWASP chapter, a meetup. What this is Everything a security event needs, on one machine you control: GitHub sign-in, teams, a live leaderboard, an...

skytrack

About skytrack is a command-line based plane spotting and aircraft OSINT reconnaissance tool made using Python. It can gather aircraft information using various data sources, generate a PDF report for a specified aircraft, and convert between ICAO and Tail Number designations. Whether you are a...

CVE-2022-1388

CVE-2022-1388 Impact This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. There is no data plane exposure; this is a...