Invoke-DOSfuscation

Invoke-DOSfuscation v1.0 Introduction Invoke-DOSfuscation is a PowerShell v2.0+ compatible cmd.exe command obfuscation framework. White paper: https://www.fireeye.com/blog/threat-research/2018/03/dosfuscation-exploring-obfuscation-and-detection-techniques.html Background Over the past several yea...

BIT-KYVERNO-2026-84196 Kyverno before 1.18.0 Server-Side Request Forgery via apiCall

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

EUVD-2026-77213

Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla 7.0.0, Snippets Pro extension for Joomla 11.0.0 - Snippets substitutes variable values supplied by an article tag into saved Snippet content. The affected versions do not consider the...

CVE-2026-84196

A flaw was found in Kyverno. This server-side request forgery SSRF vulnerability in apiCall.service.url allows authenticated users to send arbitrary HTTP requests. By injecting user-controlled input through variable substitution, attackers can target internal services, cloud metadata endpoints, a...

SUSE CVE-2026-84196

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84196

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84196 Kyverno before 1.18.0 Server-Side Request Forgery via apiCall

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84196 Kyverno before 1.18.0 Server-Side Request Forgery via apiCall

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84196 Kyverno before 1.18.0 Server-Side Request Forgery via apiCall

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84196

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84196

Kyverno before 1.18.0 is affected by a server-side request forgery (SSRF) in the apiCall.service.url field. The root cause is variable substitution that allows authenticated users to inject user-controlled input, enabling arbitrary outbound HTTP requests to internal services, cloud metadata endpo...

EUVD-2026-69033

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84196: Server-Side Request Forgery (SSRF)

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-18501

The CVE concerns the UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress. It is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to and including 1.2.69, caused by insufficient input sanitizati...

CVE-2026-18501: Improper Neutralization of Input During Web Page Generation

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

PT-2026-68493

Name of the Vulnerable Software and Affected Versions UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress versions prior to 1.2.70 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping...

EUVD-2026-44783

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as $deptId are processed by SqlparserUtils.transFilter, whose final branch returns raw user input for non-in and non-between operators before SubstitutedSql.replace"$var", valu...

CVE-2026-47125

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/id/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's compose file, is missing an admin...

Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF

Summary A Server-Side Request Forgery SSRF vulnerability in Kyverno allows authenticated users to induce the admission controller to send arbitrary HTTP requests to attacker-controlled endpoints. When a ClusterPolicy uses apiCall.service.url with variable substitution e.g. request.object.,...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ClusterPolicy when apiCall.service.url is used with variable substitution e.g. request.object.. An attacker can retrieve sensitive information from internal services or cloud metadata endpoints b...