CVE-2026-72688 OpenSignLabs opensignserver - Missing Authentication for Critical Function

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...

CVE-2026-72688 OpenSignLabs opensignserver - Missing Authentication for Critical Function

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

SummaryOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and doe...

PYSEC-2026-3645 Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...

WD NAS - language_configuration RCE Detection (CVE-2018-18472)

Detects CVE-2018-18472 by injecting id via PUT /api/1.0/rest/languageconfiguration backticks and fetching the written output file. !/usr/bin/env python3 -- coding: utf-8 -- """Western Digital My Cloud / My Book Live languageconfiguration RCE CVE-2018-18472.""" import re from kittysploit import fr...

WD NAS - language_configuration RCE (CVE-2018-18472)

Exploits backtick injection in PUT /api/1.0/rest/languageconfiguration on WD My Cloud / My Book Live. Output is written under /var/www and fetched via HTTP. !/usr/bin/env python3 -- coding: utf-8 -- """Western Digital NAS languageconfiguration RCE CVE-2018-18472 — opens execute session.""" import...

EMC CTA - XXE File Read Detection (CVE-2014-0644)

Detects CVE-2014-0644 by POSTing XXE to /api/login with Password= pointing at file:///etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """EMC Cloud Tiering Appliance XXE file read CVE-2014-0644.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Spring Cloud Function - routing-expression RCE (CVE-2022-22963)

Exploits CVE-2022-22963 by injecting SpEL into the spring.cloud.function.routing-expression header to run a reverse CMD payload. Waits for a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud Function routing-expression RCE CVE-2022-22963 — reverse session.""" import base64...

Spring Cloud Gateway - Actuator SpEL RCE (CVE-2022-22947)

Exploits CVE-2022-22947 by injecting SpEL into a Gateway route filter via the actuator API, reading command output from the route JSON. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud Gateway Actuator SpEL RCE CVE-2022-22947 — opens execute...

Seagate Personal Cloud - getPhotoPlaylistPhotos LFI (CVE-2017-18263)

Detects CVE-2017-18263 by requesting /getPhotoPlaylistPhotos.psp?url=/etc/passwd and checking for passwd contents. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate Personal Cloud Media Server path traversal CVE-2017-18263.""" import re from kittysploit import from lib.protocols.http.httpclien...

Spring Cloud Gateway - Actuator SpEL RCE Detection (CVE-2022-22947)

Detects CVE-2022-22947 by creating a Gateway route with a SpEL AddResponseHeader filter via /actuator/gateway/routes, refreshing, and reading command output from the route definition. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud Gateway Actuator SpEL RCE CVE-2022-22947.""" import jso...

Spring Cloud Function - routing-expression Detection (CVE-2022-22963)

Probes Spring Cloud Function endpoints for acceptance of the spring.cloud.function.routing-expression header CVE-2022-22963. Uses a non-destructive SpEL expression; confirmation of RCE requires the companion exploit with a reverse payload. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud...

Seagate Personal Cloud - File Read (CVE-2017-18263)

Reads arbitrary files via CVE-2017-18263 getPhotoPlaylistPhotos.psp?url= path. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate Personal Cloud getPhotoPlaylistPhotos file read CVE-2017-18263.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Akamai Cloud Keeps Strengthening the Foundation (Updated August 2026)

...

Nimbus Vestige — Updated!

Nimbus Vestige NV A forensic reconstruction engine for cloud and identity incident response. Given fragmented cloud, SaaS, and identity telemetry — control-plane logs, sign-in events, token and consent activity — NV reconstructs how an intrusion most likely moved across accounts and services,...

PT-2026-69829

Name of the Vulnerable Software and Affected Versions opensignserver versions prior to 2.37.1 Description A missing authentication issue allows an unauthenticated remote attacker to read arbitrary stored documents. This occurs via the fileupload Parse cloud function, which generates file access...

PT-2026-69954

Name of the Vulnerable Software and Affected Versions odh-model-controller affected versions not specified Description An authenticated user with permissions to create custom resources can exploit a flaw in the loadSecret function. The function improperly reads the Secret namespace from...

PT-2026-76478

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...

Alibaba Cloud Linux 3 : 0247: php:7.4 (ALINUX3-SA-2026:0247)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0247 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-14355: In PHP versions 8.2. before 8.2.32,...

Alibaba Cloud Linux 3 : 0244: libgcrypt (ALINUX3-SA-2026:0244)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0244 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-41989: Libgcrypt before 1.12.2 sometimes...