CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-40860

camel-jms JMS ObjectMessage 不安全反序列化复现工具 CVE-2026-40860 本项目演示了 Apache Camel 的 camel-jms 组件中存在的 Java 反序列化漏洞 （并间接影响 camel-sjms、camel-sjms2、camel-amqp、camel-activemq、camel-activemq6），该漏洞被跟踪为 CVE-2026-40860 。JmsBinding.extractBodyFromJms 方法在处理传入的 JMS ObjectMessage 时，通过 ObjectMessage.getObject...

Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

my-CVE-2021-1675

= Print Nightmare 分析报告 :imagesdir: Figures :toc: :icons: font :figure-caption: 图 :xrefstyle: short :pdf-theme: basic-theme.yml 2021 年 6 月 29 日，一个非常严重的 Windows 打印服务漏洞作为 0day 被曝光，漏洞基础评分 8.8 分，发布于 GitHub 上（现已删除）。 该漏洞就是著名的 PrintNightmare: CVE-2021-34527，危险程度甚至高于永恒之蓝。 == 漏洞基本信息 34527 漏洞几乎作用于 Windows...

horusec

目录 1. 关于 2. 快速开始 2.1. 要求 2.2. 安装 3. 使用方法 3.1. CLI 使用方法 3.2. 使用 Docker 3.3. 旧版本 3.4. 使用 Horusec-Web 应用 3.5. 使用 Visual Studio Code 3.6. 使用流水线 4. 文档 5. 路线图 6. 贡献 7. 行为准则 8. 许可 9. 社区...

keycloak__keycloak_CVE-2014-3656_1-0-5-Final

开源身份与访问管理 以最少的工作量为应用程序添加身份验证并保护服务安全。无需处理用户存储或用户身份验证。 Keycloak 提供用户联合、强身份验证、用户管理、细粒度授权等功能。 帮助与文档 文档 用户邮件列表 - 用于获取有关 Keycloak 的帮助和一般问题的邮件列表 通过访问 https://slack.cncf.io/ 创建账户，加入 Slack 上的 keycloak 提出一般性问题，或加入 keycloak-dev 进行设计与开发讨论。 报告安全漏洞 如果您发现了安全漏洞，请查阅如何正确报告漏洞的说明。 报告问题 如果您认为发现了 Keycloak 的缺陷，请提交一个问题。...

CVE-2024-51482

CVE-2024-51482 - ZoneMinder 盲 SQL 注入 目录 概述 漏洞详情 技术分析 利用指南 安装 使用示例 缓解措施 参考 概述 CVE-2024-51482 是 ZoneMinder（一款流行的开源闭路电视监控软件）中发现的一个严重基于布尔的 SQL 注入漏洞。该漏洞影响 1.37. 至 1.37.64 版本，允许具有低权限的已认证攻击者在底层数据库服务器上执行任意 SQL 命令。 指标| 值 ---|--- CVE ID| CVE-2024-51482 CVSS 评分| 9.9（严重） 攻击向量| 网络 所需权限| 低 用户交互| 无 影响范围| 已改变 影响...

CVE-2026-43866

camel-jms: Reproductor de omisión de filtro con DefaultExchangeHolder forjado CVE-2026-43866 Este proyecto demuestra la CVE-2026-43866 , una omisión bypass de la corrección de la CVE-2026-40860 en los componentes camel-jms y camel-sjms / familia JMS de Apache Camel. La CVE-2026-40860 añadió una...

Security Bulletin: Due to the use of Spring Expression Language (SpEL), IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-47886)

Summary Spring Expression Language SpEL is used by IBM Sterling Control Center as part of dependency in spring-expression-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47886 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a...

Important: Red Hat Security Advisory: Red Hat build of Kueue 1.4.3 release

Red Hat build of Kueue 1.4.3 release The Red Hat build of Kueue is an optional operator, based on Kueue upstream, to enable the installation of Kueue on Openshift. Kueue is a queueing framework for managing Kubernetes workloads. This release is based on Kueue v0.18.11...

CVE-2026-101919

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

BlackSnufkin

🎯 Resumen del Perfil Finalmente has descubierto mi perfil de GitHub. No dudes en clonar/hacer fork de los proyectos, abrir issues y enviar PRs si crees que algo podría ser mejor. Lee mi blog para write-ups e investigación - ¡Feliz Hacking! 😊 struct OffensiveOperator handle: String, role: String,...

CVE-2023-21716

CVE-2023-21716 Corrupción del montón en la tabla de fuentes RTF de Microsoft Word https://twitter.com/jduck Una vulnerabilidad en wwlib de Microsoft Office permite a los atacantes lograr la ejecución remota de código con los privilegios de la víctima que abre un documento RTF malicioso. El atacan...

EUVD-2026-92524

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2026-101919 Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2026-101919

A vulnerability exists in the HyperShift operator where it copies user-provided kubeconfig secrets directly into the privileged control plane namespace without sufficient validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this by supplying a...

CVE-2026-101919

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2026-78122-POC

CVE-2026-78122 — Prueba de concepto Tecnativadocker-socket-proxy ≤ 0.5.0 — Granularidad insuficiente del control de acceso CWE-1220 CVSS 4.0: 8.3 Alta — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N El vector de ataque es Adyacente AV:A: el atacante necesita acceso de red...

CVE-2026-104970

Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first for the first-admin check and performs account creation without an atomic transaction, row lock,...

CVE-2026-46595-proof

Prueba de CVE-2026-46595 https://vulners.com/cve/CVE-2026-46595 es https://pkg.go.dev/vuln/GO-2026-5023 una vulnerabilidad en el símbolo NewServerConn de golang.org/x/crypto/ssh como se indica en el segundo enlace. Este repositorio contiene un programa simple que demuestra una comprobación positi...