CVE-2026-75604

A flaw was found in Next.js. When running on Windows systems, the application fails to properly sanitize backslashes in request paths before building file cache locations. An unauthenticated remote attacker can exploit this directory traversal weakness by submitting crafted requests to access...

CVE-2019-6693

CVE-2019-6693 FortiGate 기본 암호화 키를 변경하셨나요? 이 스크립트를 실행해서 확인해 보세요! 전체 구성 파일 덤프 또는 개별 암호화 값을 제공할 수 있습니다. 복호화된 값이 완전한 난센스가 아니거나 단어를 만들어낸다면, 암호화 키가 기본값으로 설정되어 있을 가능성이 높습니다. 설치 git clone https://github.com/Real4XoR/cve-2019-6693.git cd cve-2019-6693 pip3 install -r requirements.txt 사용법 전체 .conf 구성 파일을...

CVE-2025-69428

보안 권고 - CVE-2025-69428 제목: 인증되지 않은 민감 디렉토리 접근 정보 노출 CVE 식별자: CVE-2025-69428 설명 로컬에 배포된 Pro-Bit 애플리케이션 v1.77.4 미만 버전에서 인증되지 않은 공격자가 민감한 디렉토리 및 그 하위 디렉토리에 직접 접근할 수 있는 중요한 접근 제어 취약점이 존재합니다. 해당 디렉토리는 인증이나 권한 검사 없이 공개적으로 접근 가능했으며, 다음과 같은 매우 민감한 파일이 포함되어 있었습니다: 평문 사용자 자격 증명 및 해당 도메인 계정 데이터베이스 연결 문자열 내부...

synodecrypt

SynoDecrypt 모든 Synology 암호화 아카이브SPK, PAT, ...를 해독하는 도구입니다. 리버스 엔지니어링 작업은 블로그 게시물에 설명되어 있습니다. 설치 pip install -r requirements.txt 사용법 먼저 암호화 키를 추출하여 JSON 파일예: keys.json에 넣어야 합니다. 이 JSON 파일은 다음 형식이어야 합니다: "keypairs": "keytypes": 0, 1, 2, "signing": "hexsigningkey", "master": "hexmasterkey" ,...

BIT-RCLONE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

PT-2026-99019

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

SUSE-SU-2026:23792-1 Security update for kronosnet

This update for kronosnet fixes the following issues: - CVE-2026-15811: improper sanitization of sensitive memory locations following cryptographic configuration adjustments can lead to potential exposure of encryption keys bsc1271923. - CVE-2026-15812: improper verification of packet origins...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: The “binding mark” of a reused connection was unset. Steve French reported a null pointer dereference error from the sha256 lib. The cifs.ko module can send session setup requests using a reused connection. If a reused...

Astra Linux – Vulnerability in Thunderbird

Thunderbird did not check whether the user ID associated with an OpenPGP key has a valid self-signature. An attacker may create a forged version of an OpenPGP key, either by replacing the original user ID or by adding another user ID. If Thunderbird imports and accepts the forged key, the...

Astra Linux – Vulnerability in Linux

The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP does not require that all fragments of a frame be encrypted with the same key. An adversary can exploit this weakness to decrypt selected fragments when another device sends fragmented...

CVE-2026-86597 Sensitive information written to logs by Snowflake drivers

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...

CVE-2026-16693

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to the use of hardcoded cryptographic constants to obfuscate encryption keys...

EUVD-2026-71486

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to the use of hardcoded cryptographic constants to obfuscate encryption keys...

CVE-2026-51617

Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics...

CVE-2026-51617

The TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability in the getSysStatusCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to extract sensitive information, including the firmware version...

CVE-2026-79780: Exposure of Sensitive Information to an Unauthorized Actor

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

EUVD-2026-57612

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the downloadexport method. Attackers can craft requests with ../ sequences to escape th...

PT-2026-71339

Name of the Vulnerable Software and Affected Versions rConfig versions prior to 8.2.13 Description Authenticated attackers can read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download export method. By using ../ sequences, an attack...

OESA-2026-3281 kronosnet security update

The kronosnet source Security Fixes: A vulnerability was found in kronosnet's version =1.34 cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw...

GHSA-8MXV-9XHP-86H4 rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys

Summary The S3 redirect callback strips X-Amz-Security-Token when a redirect changes scheme or host, but it does not strip IBM IAM bearer authorization or customer-provided encryption keys. Two independently validated paths remain: - a same-host HTTPS-to-HTTP redirect preserves Authorization:...