CVE-2024-42009-roundcube-xss

CVE-2024-42009 — Roundcube Webmail 1.6.6 Stored XSS PoC For authorised security testing, CTF environments, and educational research only. Using this tool against systems you do not own or have written permission to test is illegal under the Computer Misuse Act 1990 UK, the CFAA US, and equivalent...

CVE-2026-73310

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an...

CVE-2026-73310 XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an...

CVE-2026-73310 XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an...

CVE-2026-73310

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can then exchange an int...

EUVD-2026-72781

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an...

CVE-2026-80219

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval GrantMethod: auto and no client secret public client. The redirect URIs are derived from the operator-created Route, whose hostname is...

CVE-2026-80219 Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret enables oauth token theft

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval GrantMethod: auto and no client secret public client. The redirect URIs are derived from the operator-created Route, whose hostname is...

EUVD-2026-72694

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval GrantMethod: auto and no client secret public client. The redirect URIs are derived from the operator-created Route, whose hostname is...

CVE-2026-80219 Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret enables oauth token theft

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval GrantMethod: auto and no client secret public client. The redirect URIs are derived from the operator-created Route, whose hostname is...

CVE-2026-80219

A flaw in hawtio-operator (OpenShift cluster mode) allows OAuth token theft. The operator creates a cluster-scoped OAuthClient with GrantMethod: auto and no client secret (public client). Because redirect URIs are derived from an operator-created Route whose hostname is tenant-controlled via the ...

CVE-2026-80219

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval GrantMethod: auto and no client secret public client. The redirect URIs are derived from the operator-created Route, whose hostname is...

cve-2026-41200-stig-manager-oidc-reflected-xss

CVE-2026-41200 — STIG Manager OIDC Reflected XSS PoC Conceptual Proof of Concept for the reflected Cross-Site Scripting XSS vulnerability in STIG Manager versions 1.5.10 through 1.6.7. Vulnerability Summary A reflected XSS vulnerability exists in the STIG Manager Web App OIDC authentication error...

lenovo-dispatcher-poc

Lenovo Dispatcher PoC This is a basic proof of concept to exploit lenovo dispatcher driver LnvMSRIO.sys CVE-2025-8061. Vulnerabilities found by Luis Casvella source: https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061.html. The main idea of this poc is to exploit the read/write...

CVE-2026-86492

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service SaaS offerings through information technology IT help desk vishing, adversary-in-the-middle AitM token theft, and residential-proxy sign-ins...

cve-2025-7771

CVE-2025-7771 — ThrottleStop.sys LPE Proof-of-concept for CVE-2025-7771. ThrottleStop.sys exposes two IOCTL handlers that allow arbitrary physical memory read/write with no access control — any admin process can read or write anywhere in physical RAM. Tested on Windows 10 22H2 and Windows 11 23H2...

CVE-2024-26229-BOF

CVE-2024-26229 BOF Beacon Object File implementation of CVE-2024-26229 — Windows CSC driver local privilege escalation via DKOM token theft. Based on RalfHacker/CVE-2024-26229-exploit, converted to BOF with Dynamic Function Resolution DFR for use with C2 frameworks that support the Cobalt Strike...

RPC-Backdoor

RPC Backdoor Emulation This project is a basic implementation of an "RPC Backdoor" meant to emulate TTPs used by certain groups. The project contains an RPC server with five functions: Execute a command with cmd.exe /c and the CreateProcess API call. Steal a token and execute a command with cmd.e...

CVE-2025-22381

CVE-2025-22381: Host Header Injection in Aggie Detailed analysis and Proof-of-Concept for CVE-2025-22381, a Host Header Injection vulnerability discovered in the Aggie Open-Source Project. Vulnerability Overview+ CVE ID: CVE-2025-22381 Published: October 2025 MITRE assignment Disclosed publicly:...