632 matches found
cve-2017-12945
CVE-2017-12945 Exploit for CVE-2017-12945 A remote authenticated blind OS command injection vulnerability exists in Mersive Solstice Pods - a wireless collaboration and presentation platform designed by Mersive Technologies Inc. - running versions of the firmware prior to 2.8.4, as...
kubebox
= Kubebox small^⎈❏^ Antonin Stefanutti https://github.com/astefanutti@astefanutti // Meta :description: Terminal and Web console for Kubernetes // Settings :idprefix: :idseparator: - :experimental: // Aliases ifdef::env-github :note-caption: ℹ️ :icon-check: ✔️ :icon-edit: ✏️ endif::...
kube-monkey
kube-monkey kube-monkey is an implementation of Netflix's Chaos Monkey for Kubernetes clusters. It randomly deletes pods in the cluster, encouraging and validating the development of failure-resilient services. Apps opt in with a label, terminations happen during the hours and days you pick, and...
poc_CVE-2018-1002105
CVE-2018-1002105 PoC Authenticated PoC Demo Usage Unauthenticated PoC Demo Usage Authenticated PoC Proof-of-Concept exploit for CVE-2018-1002105. The current exploit requires create and get privileges on pods and pods/exec. Support has been added for portforward and attach, which require similar...
CVE-2026-19598-PoC
CVE-2026-19598-PoC Proof of Concept for CVE-2026-19598 affecting Pods ⚠️ Security Research / Authorized Testing Only This repository contains a Proof of Concept for CVE-2026-19598. Affected Software WordPress Pods = 3.3.9 Vulnerability Unauthenticated privilege escalation. PoC The PoC demonstrates...
popeye
Popeye: Kubernetes Live Cluster Linter Popeye is a utility that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations. As Kubernetes landscapes grows, it is becoming a challenge for a human to track the slew of manifests and policies that orchestra...
Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...
CVE-2026-19598-
CVE-2026-19598 — Pods WordPress Plugin Unauthenticated Privilege Escalation -red.svg Critical Unauthenticated Privilege Escalation CVSS 9.8 — WordPress Pods Plugin ≤ 3.3.9 This tool exploits CVE-2026-19598 , a vulnerability in the WordPress Pods plugin that allows unauthenticated attackers to...
CVE-2026-19598
🚨 CVE-2026-19598 https://plugins.trac.wordpress.org/browser/pods/tags/3.3.9/includes/general.phpL400 The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists...
CVE-2026-111671
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in viewnotebook.py, viewinferenceserving....
EUVD-2026-102962
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in viewnotebook.py, viewinferenceserving....
CVE-2026-111671 Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in viewnotebook.py, viewinferenceserving....
CVE-2026-111671 Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in viewnotebook.py, viewinferenceserving....
CVE-2026-111671
Versions of Cube-studio up to and including 2026.09.01 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The vulnerability exists in the view_notebook.py , view_inferenceserving.py , and view_serving.py files, where lifecycle endpoints fail to properly validate ownership. This al...
PT-2026-116070
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view notebook.py, view...
CVE-2026-111671: Authorization Bypass Through User-Controlled Key
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in viewnotebook.py, viewinferenceserving....
CVE-2026-50125 MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion
MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated getresource tool, which accepts attacker-controlled limitBytes and tailLines values for the pods logs subresource...
EUVD-2026-81088
Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod...
GO-2026-6357 OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods in github.com/openchoreo/openchoreo
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods in github.com/openchoreo/openchoreo...
