CVE-2025-62506

CVE-2025-62506 Vulnerability Verification Script Overview This repository contains a verification script for CVE-2025-62506, a privilege escalation vulnerability in MinIO service accounts and STS Security Token Service accounts. Vulnerability Description CVE-2025-62506 is a privilege escalation...

CVE-2026-55040

Microsoft SharePoint JWT Authentication Bypass CVE-2026-55040 Overview CVE-2026-55040.py is a proof-of-concept script to leverage the SharePoint authentication bypass vulnerability, CVE-2026-55040. For a full technical analysis, see our Rapid7 Analysis. Usage $ python CVE-2026-55040.py --help...

bucky

Bucky An S3 account ID enumeration and bucket discovery tool Given a single accessible S3 bucket, bucky extracts the 12-digit AWS account ID that owns it, then discovers additional buckets belonging to the same account by fuzzing bucket names against a wordlist — all in one command. What It Does ...

CVE-2026-105770

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claimpattern names and regular expressions in its...

CVE-2026-105770 Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claimpattern names and regular expressions in its...

EUVD-2026-115653

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claimpattern names and regular expressions in its...

CVE-2026-105770 Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claimpattern names and regular expressions in its...

CVE-2026-105770

Octo STS (github.com/octo-sts/app ) versions prior to 0.11.2 are vulnerable to a sensitive information disclosure vulnerability. The TrustPolicy.CheckToken function includes internal policy details—such as issuer, subject, audience values, patterns, and regular expressions—within PermissionDenied...

CVE-2026-105770: octo-sts app: Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does…

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claimpattern names and regular expressions in its...

PT-2026-135833

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claim pattern names and regular expressions in its...

MAL-2026-18487 Malicious code in @ifasn/mdd-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8295dd6d1f932aa9f2b865822f1a6f213e00fc288b35cd4b7d8fa0f07a8641 On load, index.js queries the Alibaba Cloud ECS instance metadata service at 100.100.100.200, performs the IMDSv2-style PUT to obtain a metadata toke...

Malicious code in @ifasn/mdd-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8295dd6d1f932aa9f2b865822f1a6f213e00fc288b35cd4b7d8fa0f07a8641 On load, index.js queries the Alibaba Cloud ECS instance metadata service at 100.100.100.200, performs the IMDSv2-style PUT to obtain a metadata toke...

CVE-2026-97468 Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...

io.quarkiverse.cxf:quarkus-cxf-integration-test-ws-trust (>=3.35.0, <=4.0.0.beta1), io.quarkiverse.cxf:quarkus-cxf-services-sts (>=3.35.0, <=4.0.0.beta1) +8 more potentially affected by CVE-2026-97468 via org.apache.cxf.services.sts:cxf-services-sts-core (>=4.2.0, <=4.2.3)

org.apache.cxf.services.sts:cxf-services-sts-core MAVEN version =4.2.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.3 Source cves: CVE-2026-97468 Source advisory: MEND:CVE-2026-97468...

CVE-2026-97468 Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...

io.quarkiverse.cxf:quarkus-cxf-integration-test-ws-trust (>=2.0.0.alpha1, <=3.33.14), io.quarkiverse.cxf:quarkus-cxf-services-sts (>=2.0.0.alpha1, <=3.33.14) +20 more potentially affected by CVE-2026-97468 via org.apache.cxf.services.sts:cxf-services-sts-core (>=4.0.0, <=4.1.8)

org.apache.cxf.services.sts:cxf-services-sts-core MAVEN version =4.0.0, =2.0.0.alpha1, =2.0.0.alpha1, =2.0.0.alpha1, =3.0.0-m1, =3.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =7.3.7.final, =7.0.0.final, =6.2.0.final, =8.0.0.beta1 and more Source cves: CVE-2026-97468 Source advisory...

com.savoirtech.aetos:aetos (>=4.2.0.1, <=4.3.1), com.treelogic-swe:aws-mock (1.0) +141 more potentially affected by CVE-2026-97468 via org.apache.cxf.services.sts:cxf-services-sts-core (>=2.5.0, <=3.6.12)

org.apache.cxf.services.sts:cxf-services-sts-core MAVEN version =2.5.0, =4.2.0.1, =ec2-2013-02-01, =7.2.0, =6.3.0, =1.2.0, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.7, =1.0.7, =1.0.0, =1.0.2 and more Source cves: CVE-2026-97468 Source advisory: MEND:CVE-2026-97468...

ceph: ceph: RGW STS session tokens vulnerable to CBC bit-flip attack enabling admin privilege escalation

A flaw was found in Ceph RGW's STS Security Token Service session token implementation. The STS tokens use the same unauthenticated AES-128-CBC encryption as CephX, which lacks message authentication and uses a hardcoded initialization vector. Because there is no integrity protection on the token...

CVE-2026-103649

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

CVE-2026-103649 Synchronous Access of Remote Resource without Timeout in hMailServer

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...