CVE-2026-15978

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights...

SUSE CVE-2026-55435

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, AI Bridge proxy endpoints authenticate via Server.IsAuthorized in coderd/aibridgedserver, which validates key format, expiry, secret...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

CVE-2026-15977: Insufficiently Protected Credentials

SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...

PT-2026-66562

Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description An issue exists where the '/server info' endpoint returns sensitive API keys and SSL keyfile information. This occurs specifically when only the --admin-api-key is configured. Recommendations ...

CVE-2026-67425

CVE-2026-67425 affects Flyto2 Core. Prior to version 2.26.6, the component llm.chat reads provider keys (e.g., OPENAI_API_KEY, ANTHROPOLIC_API_KEY) from the environment and transmits them in an Authorization: Bearer header to a caller-controlled base_url, enabling an attacker to exfiltrate the op...

CVE-2026-67425 Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAIAPIKEY and ANTHROPICAPIKEY from the environment and sends them in the Authorization: Bearer header to caller-controlled baseurl, allowing an attacker to receive th...

vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects

A flaw was found in Eclipse Vert.x. The DefaultRedirectHandler in vertx-core improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a...

Adlisting Classified Ads 2.14.0 - Information Disclosure Detection

Information disclosure issue in the redirect responses, When accessing any page on the website, Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects. !/usr/bin/env python3 -- coding: utf-8 -- """Information disclosure issue in the redirect...

XWiki < 4.10.15 - Sensitive Information Disclosure Detection

XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are...

Visual Studio Code MCP Configuration ("mcp.json") Exposure Detection

Detected exposed VS Code MCP Model Context Protocol configuration files mcp.json which may contain sensitive information including API keys, server endpoints, authentication tokens, and tool configurations for AI assistants and language models. !/usr/bin/env python3 -- coding: utf-8 -- """Detecte...

Elastic Cloud API Key Detection

Detects Elastic Cloud API keys used for programmatic access to the Elastic Cloud and serverless APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Elastic Cloud API keys used for programmatic access to the Elastic Cloud and serverless APIs.""" import re from kittysploit import from...

Ruby Gem::ConfigFile Credential - Exposure Detection

Ruby Gem credentials file is exposed, potentially leaking RubyGems API keys. The /.gem/credentials file stores authentication tokens for publishing gems to RubyGems.org or private gem servers. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby Gem credentials file is exposed, potentially leaking...

CVE-2026-65589

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in...

EUVD-2026-47633

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in...

PT-2026-63347

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 Description Custom HTTP header credentials used in LLM sub-nodes, such as OpenAI, Anthropic, and Lemonade, are not properly masked during execution. While these values appear masked in the user interface, they ar...

CVE-2026-65589: Insertion of Sensitive Information into Log File

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in...

CVE-2026-62233

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

CVE-2026-62230

Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...

CVE-2026-62231

The Grav API plugin getgrav/grav-plugin-api before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created...