Docker-Proxy hubcmdui - Missing Authentication on /api/config

Docker-Proxy through 5.1.9 exposes the hubcmdui configuration endpoint /api/config without authentication. An unauthenticated remote attacker can read the full server configuration, including the WeChat/Telegram monitoring webhook URLs and bot token inside monitoringConfig, the menuItems structur...

CVE-2026-121449

Versions of Dockhand from 1.0.47 before 1.0.54 are vulnerable to a Secret Disclosure flaw via the Git stack webhook . The root cause is that the deployStack() function attaches resolved secret values to its result as resolvedSecrets, which the Git-stack routes then return unfiltered. Attackers wh...

CVE-2026-121449 Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook

Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack...

CVE-2026-121449 Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook

Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack...

Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx...

EUVD-2026-114789

Workflows triggered by a pull request review were read from the commit named in the review's commitid, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit...

Exploits

Exploits Original CVEs, exploit PoCs and security advisories by @kmkz · boffsec-services.com · @kmkzsecurity 2026 File| Target| Type| CVSSv3 ---|---|---|--- CVE-2026-22191-SicuroWeb-ATI-chain.txt| SicuroWeb / Beghelli Sicuro24| Advisory 3-CVE chain| 9.3 CVE-2026-22191-POC.py| SicuroWeb / Beghelli...

CVE-2022-45771

CVE-2022-45771 The PwnDoc is vulnerable to both path traversal and local file inclusion LFI, which allows unprivileged users to disclose JWT secrets and achive code execution. Requirements: An attacker has valid account with user role The application has a report template with either...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of...

PT-2026-134878

Workflows triggered by a pull request review were read from the commit named in the review's commit id, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commi...

CVE-2017-1000486

CVE-2017-1000486 This is a PoC of CVE-2017-1000486 with some payloads useful to bypass blacklisting lexicographic checks on standard functions used to achieve RCE getClass, exec, etc.. and for retrieving primefaces secret through Padding Oracle in order to be less noisy possible on exploitation...

CVE-2026-46726

CVE-2026-46726 — camel-vertx-websocket Header Injection SSRF + Secret Disclosure Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| WebSocket feed ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 +...

CVE-2026-55993

camel-atmosphere-websocket Header Injection Reproducer CVE-2026-55993 This project demonstrates a message-header injection in Apache Camel's camel-atmosphere-websocket component, tracked as CVE-2026-55993. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange...

CVE-2025-10897

CVE-2025-10897 WooCommerce is an open-source e-commerce plugin for WordPress that turns websites into online stores. WooCommerce Designer Pro is a WordPress plugin developed by JMA Plugins that enables customers to design and customize products directly on WooCommerce stores. IMPORTANT :...

CVE-2026-3288-lab

CVE-2026-3288 Vulnerable Lab Docker NGINX Ingress Controller Configuration Injection ⚠️ WARNING : This lab contains intentionally vulnerable configurations for AUTHORIZED SECURITY TRAINING ONLY Vulnerability Overview CVE-2026-3288 CVSS 8.8 HIGH - Configuration injection in NGINX Ingress Controller...

CVE-2026-3288

CVE-2026-3288: ingress-nginx Configuration Injection via rewrite-target Annotation Keywords: CVE-2026-3288, ingress-nginx vulnerability, Kubernetes security, nginx configuration injection, rewrite-target annotation, RCE, Secret disclosure, CWE-20, CAPEC-176, ingress-nginx CVE 2026, Kubernetes...

CVE-2026-117688 Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration

A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. ...

CVE-2026-117688

A flaw in the client registration component of Keycloak , an open-source identity and access management solution, allows for vault secret disclosure . When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the sys...

CVE-2026-101273

The Pretix platform is affected by a gift card enumeration vulnerability. Certain API endpoints fail to validate auto-incremented internal IDs when creating order payments, allowing an attacker to reference gift cards belonging to different organizers. This flaw enables the retrieval of secret ke...

CVE-2026-110020 Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...