Lucene search
+L

401 matches found

Kitploit
Kitploit
added 2026/09/12 1:03 a.m.7 views

css-the-bomb-inside-your-inbox

CSS: la bomba dentro de tu bandeja de entrada Bienvenido al repositorio. Este repositorio contiene todos los materiales de mi charla "CSS: la bomba dentro de tu bandeja de entrada". Este repositorio contiene código de prueba de concepto, casos de prueba y material de apoyo que fueron identificado...

5.9AI score
SaveExploits0
RedhatCVE
RedhatCVE
added 2026/09/11 6:41 p.m.4 views

CVE-2026-84195

A flaw was found in Kyverno, a policy engine for Kubernetes. This vulnerability allows attackers with low privileges to exfiltrate the admission controller's ServiceAccount token. By directing apiCall requests to external or attacker-controlled endpoints, the token is automatically attached witho...

8.3CVSS0.00287EPSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/10 9:04 p.m.8 views

RocketChat-NoSQLi-Chain-CVE-2021-22911

Rocket.Chat NoSQLi Token Leak & Password Reset An automated exploit script for Rocket.Chat and Meteor-based applications that leverages a NoSQL Injection via the $where clause to leak password reset tokens through server-side exceptions. Once the token is leaked, the script performs an...

9.8CVSS8.2AI score0.95242EPSS
SaveExploits16
Kitploit
Kitploit
added 2026/09/08 3:53 p.m.7 views

CVE-2026-27886-PoC-Account-Takeover

CVE-2026-27886 Automated Exploit - Usage Guide What This Script Does Automates the full account takeover chain in 4 HTTP request groups: 1. Vulnerability Verification - Confirms the target is vulnerable 2. Email Enumeration - Extracts admin email via boolean oracle 500 requests 3. Password Reset...

9.2CVSS6.1AI score0.00612EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/08 9:15 a.m.4 views

CVE-2026-25253

CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw 1-Click Remote Code Execution PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e Description CVE-2026-25253 : OpenClaw Authentication Token Exfiltration Vulnerability description: OpenClaw aka clawdbo...

8.8CVSS7.7AI score0.23992EPSS
SaveExploits7References1
SUSE CVE
SUSE CVE
added 2026/09/02 1:00 a.m.11 views

SUSE CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

8.3CVSS5.9AI score0.00287EPSS
SaveExploits0References3
NVD
NVD
added 2026/09/01 12:17 p.m.12 views

CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

8.3CVSS0.00287EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/09/01 11:33 a.m.14 views

CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

8.3CVSS5.9AI score0.00287EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/01 11:33 a.m.14 views

EUVD-2026-69032

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

8.3CVSS5.9AI score0.00287EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/01 11:33 a.m.18 views

CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests when using apiCall service mode , without requiring explicit authorization headers. An attacker can exploit this by directing apiCall requests to external or attacker-controlled ...

8.3CVSS5.9AI score0.00287EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/01 11:33 a.m.19 views

CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

8.3CVSS5.9AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/09/01 11:33 a.m.36 views

CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

8.3CVSS0.00287EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/01 11:33 a.m.7 views

EUVD-2026-69030

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

5.8CVSS5.8AI score0.0027EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/09/01 12:00 a.m.14 views

PT-2026-84158

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

8.3CVSS5.9AI score0.00287EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/08/28 5:17 p.m.10 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the authorize.html process. An attacker can execute arbitrary JavaScript in a user's browser by tricking the user into visiting a specially crafted URL, which can result in the exfiltration of session tokens...

7.1CVSS6AI score0.00361EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/08/28 5:17 p.m.13 views

Yamcs has Reflected XSS in the URL of the Authorize Endpoint

Attack type: Unauthenticated remote Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token. Affected components: authorize.html, AuthHandler.java, HandlerContext.java A Reflected Cross-Site Scripting vulnerability...

6.5CVSS6.1AI score0.00361EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/08/28 5:17 p.m.9 views

GHSA-RXPG-WJF8-QV9C Yamcs has Reflected XSS in the URL of the Authorize Endpoint

Attack type: Unauthenticated remote Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token. Affected components: authorize.html, AuthHandler.java, HandlerContext.java A Reflected Cross-Site Scripting vulnerability...

6.5CVSS6.1AI score0.00361EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/24 2:51 p.m.46 views

CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

8CVSS0.00216EPSS
SaveExploits0References1
GithubExploit
GithubExploit
added 2026/08/21 4:18 a.m.21 views

Exploit for Incorrect Resource Transfer Between Spheres in Openclaw

CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw...

8.8CVSS8.3AI score0.23992EPSS
SaveExploits7
Github Security Blog
Github Security Blog
added 2026/08/20 6:36 p.m.14 views

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...

5.3AI score
SaveExploits0References2Affected Software1
Rows per page
Query Builder