EUVD-2026-95882

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

CVE-2026-107807 Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

CVE-2026-107807 Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

CVE-2026-107807

The Nginx UI web interface (versions 2.0.0 through 2.5.0 ) is vulnerable to Node Secret Credential Exposure because it accepts the Node.Secret master credential via the node_secret URL query parameter. This occurs instead of requiring the X-Node-Secret header, potentially exposing the secret in a...

EUVD-2026-95811

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system...

CVE-2026-28745 Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system...

CVE-2026-28745

The Red Lion Controls N-Tron 700 Series is vulnerable to insecure credential storage. Specifically, usernames and passwords—including default credentials —are saved in the configuration file using weak encryption . A malicious actor who knows the default credentials could potentially recover othe...

EUVD-2026-95790

The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application...

Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: Security issues: CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling bsc1266608 CVE-2026-56852: Fixed infinite...

SUSE-SU-2026:4606-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: - Security issues: CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling bsc1266608 CVE-2026-56852: Fixed infini...

HikvisionExploiter_fixed

HikvisionExploiter Educational security tool for testing unsecured Hikvision exposures and checking CVE-2021-36260 in authorized environments. ⚠️ Legal and Ethical Warning This project should be used only on systems you own or have explicit permission to test. Scanning/exploitation without...

SUSE-SU-2026:24134-1 Security update for python-PyJWT

This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response bsc1283061. -...

Leaked-Credentials

To search for leaked credentials using Google Chrome's Developer Tools and regex, follow these short steps: 1. Open DevTools: In Chrome, navigate to the site you're inspecting, then open Developer Tools with Ctrl+Shift+I Windows/Linux or Cmd+Option+I macOS. 2. Go to Network Tab: Click on the...

langflow-cors-scanner

CVE-2025-34291 — Langflow Origin Validation / CORS Overview Overly permissive CORS config combined with refresh token cookie config allows credential theft. Field| Value ---|--- CVE| CVE-2025-34291 Severity| HIGH Product| Langflow CISA KEV| 2026-05-21 Attack Type| Origin Validation / CORS Auth...

WordPress Code Snippets plugin < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite) vulnerability

Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure Multisite vulnerability discovered by Sarthak Saxena in WordPress Plugin Code Snippets versions 3.10.0...

CVE-2026-106097 Code Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite)

The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network tho...

CVE-2026-106097

The Code Snippets WordPress plugin versions prior to 3.10.0 is vulnerable to a UNION-based SQL injection due to insufficient sanitization and escaping of user-supplied parameters in specific snippet-migration import endpoints . This vulnerability is accessible to any user with site-administration...

jeopardize

Introducción La herramienta Jeopardize está desarrollada para proporcionar capacidades básicas de inteligencia y respuesta contra amenazas de dominios de phishing al mínimo costo posible. Detecta candidatos a dominios de phishing registrados typosquatting, homógrafos, etc., los analiza y les asig...

pickl3

Pickl3 Pickl3 es una herramienta de phishing de credenciales de usuario activo de Windows. Puedes ejecutar Pickl3 y realizar phishing de la credencial del usuario objetivo. Uso Operativo - 1 Hoy en día, dado que el sistema operativo de muchos usuarios finales es Windows 10, no podemos robar...

anteater

Anteater - Marco de Verificación de Puerta CI/CD Descripción Anteater es un marco abierto para evitar la fusión no deseada de cadenas nominadas, nombres de archivo, binarios, funciones obsoletas, código/credenciales de entorno de staging, etc. Cualquier cosa que pueda especificarse con sintaxis d...