kong

Kong: The Agentic Reverse Engineer LLM orchestration for reverse engineering binaries What is Kong? Most tasks follow a linear relationship: the more difficult a task, the longer it usually takes. Reverse engineering and binary analysis is a task in which the actual difficulty is somewhat trivial...

Kong Admin <=2.03 - Admin API Access

Kong Admin through 2.0.3 contains an issue via docker-kong which makes the admin API port accessible on interfaces other than 127.0.0.1. id: CVE-2020-11710 info: name: Kong Admin =2.03 - Admin API Access author: pikpikcu severity: critical description: Kong Admin through 2.0.3 contains an issue v...

cve-2014-6271-mengjia-kong

Este repositorio no tiene un README...

kong-pwn

kong-pwn Usa KongAPI expuesto para actuar como un proxy y obtener URLs de metadatos o URLs internas. CVE-2020-11710 - No es una vulnerabilidad, es una mala configuración. Cómo usar root@kitploit: usage: kong-pwn.py -h -u URL -s SSRF -p PROXY kong-pwn.py: error: the following arguments are require...

CVE-2026-77180

creationtimestamp| type| source ---|---|--- 2026-09-03 08:45:16+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=2047 2026-09-03 12:45:06+00:00| seen| https://www.acn.gov.it/portale/w/f5-risolte-vulnerabilita-nei-prodotti-nginx 2026-09-03 13:45:08+00:00| seen|...

CVE-2026-63020

creationtimestamp| type| source ---|---|--- 2026-09-03 08:45:05+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=2047 2026-09-03 13:45:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mumli32zq72z...

CVE-2026-20355

creationtimestamp| type| source ---|---|--- 2026-09-03 08:45:03+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=2046 2026-09-03 08:46:09+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-24 2026-09-03 10:44:22+00:00| seen|...

CVE-2026-53313

creationtimestamp| type| source ---|---|--- 2026-08-27 08:45:08+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=2038...

CVE-2026-18674

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

EUVD-2026-60160

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674

Kong Mesh multi-zone deployments are vulnerable in the zone-to-global KDS sync: the global control plane trusts an in-band, sender-controlled ControlPlane.Identifier instead of the authenticated TLS zone identity. This allows any authenticated zone to inject, attribute, and overwrite resources in...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

PT-2026-76636

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18677

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

CVE-2026-18676

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

CVE-2026-18679

CVE-2026-18679 : Kong Mesh kuma-dp connects to the control plane over TLS without certificate verification when no CA is configured. This disables TLS peer verification for the data plane and sends the dataplane authentication token over the unverified channel. An on-path attacker can intercept t...

CVE-2026-18679 Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...

CVE-2026-18679 Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...

CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...