CVE-2026-62284

OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the console-proxy RemoteConfigResolver parses Kubernetes Secret kubeconfig data with clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. An attacker who can create or modify a Secr...

CVE-2026-62284

The OSAC operator (Kubernetes operator) is vulnerable in revision 8220502 due to improper sanitization of rest.Config when the console-proxy RemoteConfigResolver parses Kubernetes Secret kubeconfig data. An attacker with permissions to create or modify a Secret labeled osac.openshift.io/remote-cl...

CVE-2026-62284 OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy

OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the console-proxy RemoteConfigResolver parses Kubernetes Secret kubeconfig data with clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. An attacker who can create or modify a Secr...

EUVD-2026-114366

OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the console-proxy RemoteConfigResolver parses Kubernetes Secret kubeconfig data with clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. An attacker who can create or modify a Secr...

TangledWinExec

Tangled WinExec This repository is for investigation of Windows process execution techniques. Most of PoCs are given a name corresponding to the technique. Projects BlockingDLL : This toolset is for testing blocking DLL process. See README.md. CloneProcess : This directory is for process forking...

CVE-2023-32571

🐞 CVE-2023-32571 - System.Linq.Dynamic.Core Remote Code Execution Proof of Concept for CVE-2023-32571, a remote code execution vulnerability in System.Linq.Dynamic.Core 1.0.7.10 to 1.2.25. This vulnerability allows attackers to execute arbitrary code and commands when untrusted input to methods...

cve-2026-23744

CVE-2026-23744 – MCPJam Inspector Unauthenticated Remote Code Execution RCE Description Product : MCPJam Inspector Affected versions : ≤ 1.4.2 Fixed version : 1.4.3 Type : Unauthenticated Remote Code Execution RCE Attack vector : Network Authentication required : No User interaction required : No...

InlineExecute-Assembly

InlineExecute-Assembly InlineExecute-Assembly is a proof of concept Beacon Object File BOF that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module. InlineExecute-Assembly will execute any...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...

CVE-2026-62284: osac-project osac-operator: OSAC operator is a Kubernetes operator

OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the console-proxy RemoteConfigResolver parses Kubernetes Secret kubeconfig data with clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. An attacker who can create or modify a Secr...

sinter

Sinter Sinter is a 100% user-mode endpoint security agent for macOS 10.15 and above, written in Swift. Sinter uses the user-mode EndpointSecurity API to subscribe to and receive authorization callbacks from the macOS kernel, for a set of security-relevant event types. The current version of Sinte...

Malicious code in fabdeploycheck (PyPI)

Source: amazon-inspector 73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857 The package's only public API, check, spawns a Python child that fetches a JSON config from https://transfer.archivete.am/H2Uxm/fabdeploycheck-config.json using ssl.createunverifiedcontext and dispatches...

MAL-2026-17926 Malicious code in fabdeploycheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857 The package's only public API, check, spawns a Python child that fetches a JSON config from...

CVE-2026-94577

A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass...

CVE-2026-105797

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

EUVD-2026-93426

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

PT-2026-106754

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

Command Injection

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Command Injection via the googlemeet.chrome command, which accepts caller-supplied audio command arrays and executes them on a paired node without passing through the normal system.run...

CVE-2026-100599

OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...

EUVD-2026-87381

OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...