popeye

Popeye: Kubernetes Live Cluster Linter Popeye is a utility that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations. As Kubernetes landscapes grows, it is becoming a challenge for a human to track the slew of manifests and policies that orchestra...

poc_CVE-2018-1002105

CVE-2018-1002105 PoC PoC autenticado Demostración Uso PoC no autenticado Demostración Uso PoC autenticado Exploit de prueba de concepto para CVE-2018-1002105. El exploit actual requiere privilegios create y get en pods y pods/exec. Se ha añadido soporte para portforward y attach, que requieren...

kubebox

= Kubebox small^⎈❏^ Antonin Stefanutti https://github.com/astefanutti@astefanutti // Meta :description: Terminal and Web console for Kubernetes // Settings :idprefix: :idseparator: - :experimental: // Aliases ifdef::env-github :note-caption: ℹ️ :icon-check: ✔️ :icon-edit: ✏️ endif::...

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...

cve-2017-12945

CVE-2017-12945 Exploit para CVE-2017-12945 Existe una vulnerabilidad de inyección de comandos del sistema operativo remota autenticada ciega en los Mersive Solstice Pods - una plataforma inalámbrica de colaboración y presentación diseñada por Mersive Technologies Inc. - que ejecutan versiones del...

kube-monkey

kube-monkey 是 Netflix 的 Chaos Monkey 在 Kubernetes 集群上的一个实现。它会随机删除集群中的 Kubernetes k8s Pod，鼓励并验证故障弹性服务的开发。 在 Kubernetes Slack 上加入我们：kube-monkey。 kube-monkey 在每个工作日按预配置的时间（runhour，默认为上午 8 点）运行，并生成一个部署计划，这些部署将在同一天内的某个时间面对一次随机的 Pod 终止。一天内可能发生随机 Pod 终止的时间范围是可配置的，默认为上午 10 点到下午 4 点。 kube-monkey...

CVE-2026-19598-

CVE-2026-19598 — Pods WordPress Plugin Unauthenticated Privilege Escalation -red.svg Critical Unauthenticated Privilege Escalation CVSS 9.8 — WordPress Pods Plugin ≤ 3.3.9 This tool exploits CVE-2026-19598 , a vulnerability in the WordPress Pods plugin that allows unauthenticated attackers to...

CVE-2026-19598

🚨 CVE-2026-19598 https://plugins.trac.wordpress.org/browser/pods/tags/3.3.9/includes/general.phpL400 The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists...

CVE-2026-19598-PoC

CVE-2026-19598-PoC Proof of Concept for CVE-2026-19598 affecting Pods ⚠️ Security Research / Authorized Testing Only This repository contains a Proof of Concept for CVE-2026-19598. Affected Software WordPress Pods = 3.3.9 Vulnerability Unauthenticated privilege escalation. PoC The PoC demonstrates...

CVE-2026-76573

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-76573

The Pods – Custom Content Types and Fields WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the 'not_found' shortcode attribute in all versions up to and including 3.3.9.1 . The root cause is insufficient input sanitization and output escaping . Authenticated attackers with...

CVE-2026-76573 Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-71941

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Pods plugin <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'notfound' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Pods versions = 3.3.9.1...

WordPress Pods plugin 3.3-3.3.9.1 - Author+ Arbitrary File Read vulnerability

Author+ Arbitrary File Read vulnerability discovered by Erwan LR WPScan in WordPress Plugin Pods versions 3.3-3.3.9.1...

CVE-2026-74853

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

CVE-2026-74853 Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

EUVD-2026-70903

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

CVE-2026-74853

The Pods WordPress plugin versions 3.3 through 3.3.9.1 allow users with the author role or above to read arbitrary files from the server—including files outside the web root—because the plugin's display callback does not restrict which functions it may resolve to. The vulnerability only affects s...

OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

Summary OpenChoreo Workflow Plane templates were vulnerable to OS command injection because some developer-controlled workflow parameters were interpolated directly into shell program text executed through sh -c. An authenticated user with permission to configure and trigger an affected workflow...