CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...

CVE-2026-103957

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2023-54405

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

EUVD-2026-91772

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957

A Server-side request forgery (SSRF) vulnerability exists in the OAuth2 discovery handling of Loom for AWS versions prior to 1.7.0 . An authenticated remote user can exploit this by supplying a crafted discovery document address when registering a tool server or remote agent configured for delega...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2023-54405 H3C CVM Unauthenticated File Upload via fileUpload/upload Token

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

CVE-2023-54405

The H3C CVM (Cloud Virtualization Management) component of the H3C CAS cloud platform is vulnerable to an unauthenticated arbitrary file upload flaw in the /cas/fileUpload/upload endpoint. The root cause is the lack of restrictions on file types and the failure to sanitize the caller-supplied tok...

CVE-2023-54405 H3C CVM Unauthenticated File Upload via fileUpload/upload Token

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

EUVD-2023-60704

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

cve-2026-62737-lab

CVE-2026-62737: del crash a SYSTEM asistido por laboratorio Una continuación del análisis original de CVE-2026-62737 llamada indirecta arbitraria al kernel de ExecutionContext.sys. Convierte el PoC del crash en una cadena de intercambio de tokens funcional que lanza cmd.exe como SYSTEM, pero solo...

CVE-2026-9198

CVE-2026-9198 Causa de la vulnerabilidad: IBM Langflow OSS es un software de código abierto diseñado específicamente para construir y desplegar flujos de trabajo automatizados de agentes IBM Langflow OSS 1.0.0 a 1.10.0 tiene el inicio de sesión automático habilitado por defecto autologin es true ...

token-priv

Abusando de los privilegios de token para EoP Agosto de 2017 Bryan Alexander @dronesec Stephen Breen @breenmachine Este repositorio contiene todo el código y un artículo de estilo Phrack sobre la investigación del abuso de los privilegios de token para la escalada de privilegios. No dudes en...

TP-Link-Archer-CR-700-XSS-Exploit

TP-Link-Archer-CR-700-XSS-Exploit Exploiting TP-Link Archer CR-700 Router. Responsibly Disclosed to TP-Link Step 1- On you linux machine Kali or Ubuntu type the following command gedit /etc/dhcp/dhclient.conf Comment out the line below send host-name = gethostname; Copy it to the line below it an...

EUVD-2026-91742

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-75431_PowerJob_jwt_key_predictable

Clave de Firma JWT de PowerJob Predecible Clave Derivada de la URL JDBC Predeterminada → Falsificación de Tokens 1. Resumen La clave de firma JWT HS256 del servidor PowerJob se deriva decodificando en BASE64 una constante codificada concatenada con el MD5 de la URL JDBC predeterminada...

CVE-2026-80099

CVE-2026-80099 PoC Bypass de autenticación no autenticado y exploit de RCE dirigido a plugins de WordPress de Newfold que incluyen wp-module-data. Descripción general Esta herramienta explota un fallo de validación de token Bearer en el módulo wp-module-data de Newfold. Cuando un sitio de WordPre...