keyguard

keyguard Escanea bases de código, proyectos de GCP y pipelines de CI en busca de credenciales expuestas de la API de Google, antes de que sean explotadas. El problema: Google habilitó retroactivamente el acceso a la API de Gemini en claves API existentes Maps, Places, etc. que fueron diseñadas pa...

CVE-2020-5260

CVE-2020-5260 CVE-2020-5260 Demonstration Record When git executes a command like "git clone https://example.com", it requests the protocol "https" to store credentials for the host "example.com", and when the remote side requests authentication, it appends the returned credentials to the outgoin...

nuclei-CiscoRV320Dump-CVE-2019-1653

Cisco Router Configuration Exposure Vulnerability Descripción de la Vulnerabilidad Este repositorio detalla el proceso de explotación de una vulnerabilidad en ciertos routers Cisco que permite la exposición del archivo de configuración config.exp mediante una URL pública accesible. Este archivo...

claudleak

claudleak Escanea repositorios públicos de GitHub en busca de credenciales filtradas en archivos de configuración de herramientas de codificación de IA .claude/, .cursor/, .continue/, .codex/, CLAUDE.md, AGENTS.md, etc.. Utiliza TruffleHog para la detección de secretos. Ejemplo de directorio...

CVE-2026-15806

A flaw was found in Python. The HTTPPasswordMgr class in the urllib.request module did not correctly consider the URL scheme when matching stored credentials against a requested URL. This allowed credentials intended for an HTTPS secure connection to be sent over an unencrypted HTTP connection to...

CVE-2026-86597

Snowflake 's Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers write sensitive data—including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions —to diagnostic logs in paths where available log redaction did not cover all data types. An atta...

anticipator

Anticipator Seguridad en tiempo de ejecución para sistemas de IA multiagente. Anticipator detecta inyección de instrucciones, filtración de credenciales, ataques de codificación, suplantación de homoglifos, path traversal y comportamiento anómalo de agentes en pipelines de LangGraph — antes de qu...

CVE-2020-9758

CVE-2020-9758 Description An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from...

CVE-2021-21975

CVE-2021-21975 SSRF-POC - ssrf to cred leak First configure pd client. Now run ./pd deploy http-new-requests now replace the pipedream http request ex: Randomstring.m.pipedream.net in the script run this in a seperate terminal - ./pd logs new-requests | tee -a req.txt and now run this in another...

mongobleed-exploit-CVE-2025-14847

🩸 MongoBleed - CVE-2025-14847 Laboratorio de Investigación de Seguridad CVE-2025-14847 | CVSS 8.7 Alto | Divulgación de Memoria No Autenticada CVE-2025-14847 , apodado MongoBleed , permite a atacantes remotos no autenticados extraer memoria heap no inicializada explotando la lógica de descompresi...

CVE-2026-19931

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

ALPINE-CVE-2026-19931

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

EUVD-2026-72166

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

EUVD-2026-60973

CodeWhale: jsexecution leaks parent environment to model context via missing env scrub...

CVE-2026-61614 SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...

CVE-2026-61614 SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...

CVE-2025-30374

CVE-2025-30374 Class Pollution Vulnerability in Taipy Leading to RCE, XSS, DoS, and Credential Leakage Summary A class pollution vulnerability has been identified in Taipy v4.0.3 the latest version at the time of discovery. This vulnerability allows unauthorized attackers to overwrite the Taipy...

CVE-2026-21002-Serverless-Cold-Start-Credential-Leakage-via-Reused-tmp

CVE-2026-21002 – Serverless Cold Start Credential Leakage via Reused /tmp Program Code Python AWS Lambda sim root@kitploit: lambdafuncsim.py - Simulated serverless function import os, tempfile, time SECRETFILE = '/tmp/credentials' reused across warm starts def handlerevent: On first invocation,...

CVE-2026-11106-DNS-Zone-Transfer-AXFR-Information-Disclosure

CVE-2026-11106 – DNS Zone Transfer AXFR Information Disclosure Program Code Python DNS Server + Attack root@kitploit: dnsserversim.py - Simulated DNS server allowing AXFR from dnslib import DNSRecord, QTYPE, RR, TXT, A import socketserver, socket class DNSHandlersocketserver.BaseRequestHandler: d...

CVE-2026-32662

CERT/CC VU653116 | CISA Advisory ICSA-26-055-03 | All CVEs | Case Repository CVE-2026-32662: Active Debug Code in Production Advisory Field| Value ---|--- CVE| CVE-2026-32662 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 5.3 Medium Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-489 Activ...