CVE-2026-84195

A flaw was found in Kyverno, a policy engine for Kubernetes. This vulnerability allows attackers with low privileges to exfiltrate the admission controller's ServiceAccount token. By directing apiCall requests to external or attacker-controlled endpoints, the token is automatically attached witho...

css-the-bomb-inside-your-inbox

CSS：你收件箱里的炸弹 欢迎访问本仓库。本仓库包含我演讲“CSS：你收件箱里的炸弹”的全部材料。 本仓库包含仅为合法的安全研究、分析和防御性测试之目的而识别、开发或收集的概念验证代码、测试用例及辅助材料。 你可以通过以下链接阅读相关研究： 研究论文 目录 PoC CSS 热接线 通过粘贴窃取令牌 在 CSP 阻止外部资源时窃取文本节点 纯 HTML 键盘记录器 通过电子邮件进行提示注入 Outlook 篡改 Outlook Firefox 键盘记录器 Outlook 标签劫持 Outlook 净化键盘记录器 Chrome 实时键盘记录器 工具 Shazzer Hackvertor 概念...

RocketChat-NoSQLi-Chain-CVE-2021-22911

Rocket.Chat NoSQLi Fuga de Token y Restablecimiento de Contraseña Un script de explotación automatizado para Rocket.Chat y aplicaciones basadas en Meteor que aprovecha una Inyección NoSQL mediante la cláusula $where para filtrar tokens de restablecimiento de contraseña a través de excepciones del...

CVE-2026-27886-PoC-Account-Takeover

CVE-2026-27886 自动化利用 - 使用指南 脚本功能概述 通过 4 组 HTTP 请求自动完成完整的账户接管链： 1. 漏洞验证 - 确认目标存在漏洞 2. 邮箱枚举 - 通过布尔判定方式提取管理员邮箱（约 500 次请求） 3. 密码重置触发 - 启动 Strapi 的密码恢复流程 4. 令牌窃取 - 截获 40 字符的重置令牌（约 320 次请求） 5. 账户接管 - 使用窃取的令牌获取超级管理员 JWT 基本用法 仅验证模式（安全） 检查目标是否存在漏洞而不进行利用： root@kitploit: ./cve-2026-27886-exploit.py...

CVE-2026-25253

CVE-2026-25253 OpenClaw 一键RCE ★ CVE-2026-25253 OpenClaw 一键远程代码执行 PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e 描述 CVE-2026-25253：OpenClaw 认证令牌泄露漏洞 OpenClaw（又称 clawdbot 或 Moltbot）在 v2026.1.29 之前，攻击者可通过向 Control UI 提供精心构造的 gatewayUrl...

SUSE CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests when using apiCall service mode , without requiring explicit authorization headers. An attacker can exploit this by directing apiCall requests to external or attacker-controlled ...

EUVD-2026-69032

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

EUVD-2026-69030

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

PT-2026-84158

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the authorize.html process. An attacker can execute arbitrary JavaScript in a user's browser by tricking the user into visiting a specially crafted URL, which can result in the exfiltration of session tokens...

GHSA-RXPG-WJF8-QV9C Yamcs has Reflected XSS in the URL of the Authorize Endpoint

Attack type: Unauthenticated remote Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token. Affected components: authorize.html, AuthHandler.java, HandlerContext.java A Reflected Cross-Site Scripting vulnerability...

Yamcs has Reflected XSS in the URL of the Authorize Endpoint

Attack type: Unauthenticated remote Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token. Affected components: authorize.html, AuthHandler.java, HandlerContext.java A Reflected Cross-Site Scripting vulnerability...

CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

Exploit for Incorrect Resource Transfer Between Spheres in Openclaw

CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw...

GHSA-F5F4-3HH4-F54M Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...