1614 matches found
gitleaks
Gitleaks โโโโโโโ โ โโฒ โ โ โ โ โ โ โ โ โ โโโโโโโ !WARNING Gitleaks est fonctionnellement complet. Je ne fusionnerai pas de nouvelles fonctionnalitรฉs dans Gitleaks. Les futures versions ne seront que des correctifs de sรฉcuritรฉ. Je recentre mon attention sur Betterleaks license:...
AI Copilot Content Generator <=1.4.6 - Unauthenticated Task Data Exposure
AIWU AI Chatbot & Workflow Automation WordPress plugin = 1.4.6 contains a sensitive information exposure caused by unauthenticated access to getCurrentTaskResults method, letting unauthenticated attackers retrieve API keys and configuration data, exploit requires no authentication. id:...
Chuanhu Chat - Directory Traversal
The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...
WordPress Metform <=2.1.3 - Information Disclosure
WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the /core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA...
aquatone
AQUATONE Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface. Installation 1. Install Google Chrome or Chromium browser -- Note: Google Chrome is currently giving unreliable results when...
socialhunter
socialhunter !IMPORTANT This tool is no longer working, and we won't be able to fix it as it has become difficult to bypass social media protections. Crawls the given URL and finds broken social media links that can be hijacked. Broken social links may allow an attacker to conduct phishing attack...
Adlisting Classified Ads 2.14.0 - Information Disclosure
Information disclosure issue in the redirect responses, When accessing any page on the website, Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects. id: CVE-2023-4168 info: name: Adlisting Classified Ads 2.14.0 - Information Disclosure autho...
Control Web Panel (CWP) - File Inclusion
In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...
CVE-2026-41940
Based on Watch Tower POC , Supports direct shell access via websocket , and adding root api keys for persistance...
actions-secrets
SecureStack Secrets Analysis GitHub Action A GitHub Action that analyses your source code for secrets, credentials, API keys, server and database hostnames/URLS, and a lot more! When you add this to GitHub Actions we will analyze your source code to make sure there is no sensitive data in your...
nanoid: nanoid: Predictable ID generation due to integer overflow
A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...
EUVD-2026-90674
Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...
keyguard
keyguard Scan codebases, GCP projects, and CI pipelines for exposed Google API credentials โ before they get exploited. The problem: Google retroactively enabled Gemini API access on existing API keys Maps, Places, etc. that were designed to be public and embedded in client-side code. When someon...
GitLeaks
Composant GitLeaks GitLab CI Un composant GitLab CI pour Gitleaks - un outil SAST pour dรฉtecter et prรฉvenir les secrets codรฉs en dur comme les mots de passe, les clรฉs API et les jetons dans les dรฉpรดts git. Fonctionnalitรฉs Dรฉtection de secrets : Analyse les dรฉpรดts ร la recherche de secrets codรฉs e...
kyubisweep
๐ฆ KyubiSweep Hunt exposed secrets with the cunning of a fox! A lightweight, cross-platform CLI tool that scans your filesystem to detect exposed secrets, API keys, and tokens. Built with Go for maximum performance and zero dependencies. โจ Features ๐ 30+ Secret Patterns - Detects AWS, Stripe,...
CVE-2026-101061
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...
EUVD-2026-87986
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...
CVE-2026-101061 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...
CVE-2026-100862
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...
Palo Alto Expedition - SQL Injection
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expeditio...