EUVD-2026-98069

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-98070

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal...

EUVD-2026-98071

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor...

pacbot

Introduction Policy as Code Bot PacBot is a platform for continuous compliance monitoring, compliance reporting and security automation for the cloud. In PacBot, security and compliance policies are implemented as code. All resources discovered by PacBot are evaluated against these policies to...

CVE-2022-22963

CVE-2022-22963 Educational proof-of-concept automation for CVE-2022-22963, demonstrated in an authorized Hack The Box lab environment. Overview CVE-2022-22963 is a Spring Cloud Function vulnerability involving the spring.cloud.function.routing-expression header. Under vulnerable configurations, a...

CVE-2026-89113

SAP Commerce Cloud contains an SQL Injection vulnerability (CWE-89) due to insufficient validation of user-supplied input before it is used in database queries. An authenticated user can exploit this by sending specially crafted requests to affected functionality to inject arbitrary SQL commands....

EUVD-2026-98195

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to...

professional-services

Professional Services Common solutions and tools developed by Google Cloud's Professional Services team. Disclaimer This repository and its contents are not an officially supported Google product. License All solutions within this repository are provided under the Apache 2.0 license. Please see t...

CVE-2026-89111

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability (CWE-918) affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to a server they control. This allows for the exfiltration of client credentials . The v...

CVE-2026-89111 OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenantsubdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated...

EUVD-2026-98193

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenantsubdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated...

CVE-2026-89105

The SAP/cloud-security-services-integration-library contains an improper authentication vulnerability in its HybridTokenAuthenticator component. The flaw occurs because the component accepts tokens from unintended ambient IAS/XSUAA bindings , which could allow an attacker to gain unauthorized acc...

EUVD-2026-98188

The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to gain unauthorized access to the system by using tokens that...

CVE-2026-58242

The SAP Cloud Connector contains an improper authorization check that can be exploited by a low-privileged attacker using specially crafted requests. This vulnerability requires the attacker to be on an adjacent network . Successful exploitation allows the attacker to obtain limited information a...

EUVD-2026-98183

SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the attacker to obtain limited information...

kali-cloud

Kali-Cloud Build-Script Kali Linux cloud image builder viaFAI Fully Automatic Installation, forked from Debian Cloud Images. These are the same build-scripts that the Kali team uses to generate the official Kali Linux cloud images, found on kali.org/get-kali/. For more information, please see:...

CVE-2020-3956

CVE-2020-3956 PoC exploit for VMware Cloud Director RCE CVE-2020-3956 Technical advisory is available here: https://citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/...

kyverno

Kyverno Cloud Native Policy Management 🎉 📑 Table of Contents About Kyverno Non-Goals Documentation Demos & Tutorials Popular Use Cases Explore the Policy Library Getting Help Contributing Software Bill of Materials Contributors License About Kyverno Kyverno is a Kubernetes-native policy engine...

Microsoft Windows Cloud Files Mini Filter Driver CldiStreamPrepareRequestForMoreProcessing Type Confusion vulnerability

Summary A type confusion vulnerability exists in the CldiStreamPrepareRequestForMoreProcessing functionality of Windows Cloud Files Mini Filter Driver versions: 10.0.26100.8457 WinBuild.160101.0800 and 10.0.26100.8655 WinBuild.160101.0800. A specially crafted sequence of Cloud Filter API calls ca...

Microsoft Windows Cloud Files Mini Filter Driver CldiStreamCompleteRequest use-after-free vulnerability

Summary A use-after-free vulnerability exists in the CldiStreamCompleteRequest functionality of Windows Cloud Files Mini Filter Driver versions: 10.0.26100.8457 WinBuild.160101.0800. A specially crafted sequence of Cloud Filter API calls can lead to privilege escalation. An attacker can execute a...