993 matches found
conduit
Conduit The on-prem control plane for AI coding agents. Per-engineer cost attribution Β· hard budgets Β· egress governance Β· context-rot observability Β· audit-ready exports β all inside your VPC. Conduit sits between your AI coding agents Claude Code, Cursor, Codex, Aider and whatever provider you...
CVE-2022-1388
CVE-2022-1388 Impact This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. There is no data plane exposure; this is a...
CVE-2022-1388
CVE-2022-1388 BIG-IP iControl REST vulnerability CVE-2022-1388 This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services...
OpenClawMachines
OpenClaw Machines Run as many isolated OpenClaw agents as you need, on hardware you own. OpenClaw Machines is an open-source platform for runningOpenClaw in secure AI sandboxes on your own infrastructure. A control plane orchestrates your hosts, and each agent runs in its own Firecracker microVM ...
Nuclei-Template-CVE-2022-1388-BIG-IP-iControl-REST-Exposed
Nuclei Template CVE-2022-1388 BIG-IP iControl REST Exposed May 06, 2022 This only verifies the presence of the API by hitting the authentication endpoint This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP...
owasp-ctf-in-a-box
OWASP CTF in a Box A self-hosted control plane for security-learning events β one box, one free GitHub org. Run it for a university, a high school, an OWASP chapter, a meetup. What this is Everything a security event needs, on one machine you control: GitHub sign-in, teams, a live leaderboard, an...
Platypus
Platypus A host management hub for fleets of Linux machines. Install the Platypus agent on every host you own; the agent dials back to your Platypus server over TLS + protobuf; from the server you get an interactive shell, file management, and network tunnelling on every managed host β through on...
agentic-dm-gateway
Agentic DM Gateway Security control plane for LLM agents over private chat typically Discord DMs. It sits in front of your agent. It decides who may talk, whether the session is unlocked, whether the process is paused, and whether this message is safe enough to forward. Your model and tools stay...
Loom for AWS < 1.6.1 - Unauthenticated Super-Admin Access
Loom for AWS 1.6.1 contains a broken authentication caused by missing authentication for critical functions in the authentication dependency, letting remote actors obtain super-admin authority over the agent control plane, exploit requires no identity provider configured. id: CVE-2026-103956 info...
CVE-2020-5902
CVE-2020-5902 F5 BIG-IP Traffic Management User Interface TMUI Remote Code Execution In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has a Remote...
sdnpwn
What is sdnpwn? sdnpwn is a toolkit and framework for testing the security of Software-Defined Networks SDNs. For more information check out this article: https://sdnpwn.net/2017/08/22/what-is-sdnpwn/ Installation First download sdnpwn using git git clone https://github.com/smythtech/sdnpwn Make...
DELTA
DELTA: SDN SECURITY EVALUATION FRAMEWORK What is DELTA? DELTA is a penetration testing framework that regenerates known attack scenarios for diverse test cases. This framework also provides the capability of discovering unknown security problems in SDN by employing a fuzzing technique...
CVE-2026-20127
π‘οΈ CVE-2026-20127 β Cisco Catalyst SD-WAN Authentication Bypass π Overview CVE-2026-20127 is a critical authentication bypass vulnerability affecting Cisco Catalyst SD-WAN components, including controllers and management systems. A remote unauthenticated attacker can exploit improper authenticatio...
spark-rpc-stream-unauth
abraxaslabs.tech Β· github.com/abraxas Β· @abraxasnull Β· [email protected] Β· spark-rpc-stream-unauth spark-rpc-stream-unauth Class: Privilege leftover / File read Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation CVE-2020-9480 closed unauthenticated RequestSubmitDriver /...
CVE-2026-113619
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies...
CVE-2026-113619 Eclipse ioFog renders request templates before authentication
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies...
CVE-2026-113619
Eclipse ioFog Controller versions 3.8.0 through 3.9.1 is vulnerable to an uncontrolled resource consumption issue (CWE-400). The Liquid engine renders POST, PUT, and PATCH request bodies containing template substitutions before performing authentication or RBAC checks. Because the bearer check fa...
EUVD-2026-104987
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies...
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of...
GHSA-VX2M-GPQ4-8J5Q LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of...