Koh

Koh Koh 是一个 C 和 Beacon 对象文件 BOF 工具集，通过有意泄露令牌/登录会话来捕获用户凭据材料。 部分代码灵感来源于 Elad Shamir 的 Internal-Monologue 项目（无许可证）以及 KB180548。关于为何可以实现以及 Koh 的方法，请参阅本文档的技术背景部分。 关于 Koh 背后的动机及其方法的更详细解释，请参阅 Koh: The Token Stealer 文章。 @harmj0y 是该代码库的主要作者。@tifkin 协助了方法、BOF 实现以及部分令牌机制。 Koh 根据 BSD 3-Clause 许可证授权。 目录 Koh 目录...

CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

Impact When running in the highly privileged recovery mode, OpenBao was vulnerable to a timing attack against the single recovery token. This allowed an attacker to extract the recovery token and use it to perform operations against the OpenBao instance, including reading or modification of data...

CVE-2025-51471-POC

CVE-2025-51471 - Exposición de Token entre Dominios de Ollama - PoC Autor: ajtazer 🔥 Resumen Este repositorio contiene una Prueba de Concepto PoC para CVE-2025-51471 , una vulnerabilidad de Exposición de Token de Autenticación entre Dominios que afecta a todas las versiones de Ollama incluyendo l...

CVE-2026-86049

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

CVE-2026-86049

Jupyter Server (the backend for Jupyter web applications) prior to version 2.21.0 contains a token-leak flaw in the 5xx request logging path within jupyter_server/log.py. The Referer header is copied into a JSON header block without applying the same token scrubbing used for the request URI. When...

CVE-2026-86049 Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

CVE-2026-86049 Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

CVE-2026-41940

CVE-2026-41940 Exploit Automático Descripción General CVE-2026-41940 es un exploit de prueba de concepto PoC dirigido a cPanel/WHM. Este exploit demuestra una omisión de autenticación no autenticada mediante inyección CRLF para filtrar tokens de seguridad y obtener acceso de nivel root a la...

cPanelWHM-AuthBypass

Herramienta de Escaneo y Explotación de Bypass de Autenticación cPanel/WHM Herramienta de línea de comandos en Go reescrita a partir del PoC en Python de watchTowr, utilizada para detectar y explotar la vulnerabilidad de bypass de autenticación CVE-2026-41940 en cPanel/WHM. Resumen de la...

Linux Distros Unpatched Vulnerability : CVE-2026-64684

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in...

CVE-2026-61559

@zereight/mcp-gitlab (a Model Context Protocol server for GitLab) is vulnerable to Server-Side Request Forgery in versions 0.0.1 through

EUVD-2026-78907

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to...

CVE-2026-58201

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

CVE-2026-58201 Lokka: Azure Resource Manager URL path validation issue

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

CVE-2026-58201

Lokka (@merill/lokka), a Model Context Protocol server for Microsoft 365, is vulnerable to SSRF in versions prior to 2.1.2 . The root cause is in src/mcp/src/main.ts, where the tool constructs Azure Resource Manager request URLs via direct string concatenation with a user-controlled path value. A...

CVE-2026-58201 Lokka: Azure Resource Manager URL path validation issue

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

EUVD-2026-78934

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

PT-2026-92124

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

CVE-2026-55102

CVE-2026-55102 affects hashi-vault-js , a Node.js module for interacting with the HashiCorp Vault API, in versions prior to 0.5.2 . Every API method in src/Vault.js rethrows the raw AxiosError via parseAxiosError(), retaining the full Axios configuration including the X-Vault-Token header and err...