vuln-bank-mobile

💳 Aplicación Móvil de Vulnerable Bank Vulnerable Bank es una aplicación móvil intencionalmente insegura construida para ingenieros de seguridad, testers de penetración y estudiantes de seguridad de aplicaciones móviles para practicar y demostrar la explotación de prácticas de codificación insegur...

Damn-Vulnerable-Bank

Damn Vulnerable Bank 指南：https://rewanthtammana.com/damn-vulnerable-bank/ 关于应用 Damn Vulnerable Bank 是一个刻意设计存在漏洞的安卓应用程序。所有细节都记录在指南中，点击此处。 即将举行的会议 NoNameCon https://cfp.nonamecon.org/nnc2021/talk/WCKLTN/ Black Hat Europe 待定 功能特性 注册 登录 个人资料界面 修改密码 设置界面（更新后端URL） 转账/查看资金前添加指纹检查 转账/查看资金前添加PIN码检查 查看余额 转账...

CVE-2025-55183

CVE-2025-55183 Scanner for React Server Functions source code exposure vulnerability. What is this? CVE-2025-55183: React 19.0.0-19.2.1 Server Actions can be exploited to expose their full source code including hardcoded secrets, API keys, and database credentials. References:...

autonoma

Autonoma Autonoma detecta secretos hardcodeados y los reemplaza con referencias aos.environ... usando reescrituras del AST. Los cambios se aplican solo cuando la reescritura es determinista y preserva la semántica. Las reescrituras usan el árbol sintáctico analizado — no regex sobre texto crudo...

CanoP

CanoP CLI Una herramienta de análisis estático rápida y autónoma diseñada específicamente para detectar vulnerabilidades introducidas por asistentes de codificación con IA. CanoP analiza tu base de código localmente para identificar riesgos de seguridad en código generado por IA. Características...

GitLeaks

GitLeaks GitLab CI 组件 一个用于 Gitleaks 的 GitLab CI 组件 —— 一款用于检测和防止硬编码秘密（如密码、API 密钥和令牌）被提交到 git 仓库的 SAST 工具。 功能特性 秘密检测 ：扫描仓库中的硬编码秘密和敏感信息 全面规则集 ：包含大量内置规则，用于检测各类秘密 自定义配置 ：支持本地和远程配置文件 多种输出格式 ：支持 JSON、SARIF 及其他报告格式 灵活参数 ：可直接向 Gitleaks 传递附加标志 远程配置 ：从远程 URL 下载并使用配置文件 可配置作业设置 ：可自定义作业名称、阶段和容器镜像 使用方法 基本用法...

credactor v2.7.2

Credactor Find the secret. Fix it. Commit clean. Secret scanners are good at sounding the alarm and not much help putting it out. They hand you a list of leaked credentials and leave the cleanup to you. Credactor closes the loop: it finds a hardcoded secret and rewrites it in place, so a leak goe...

PYSEC-2026-3768

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

PYSEC-2026-3768

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74893

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74893

openssl_encrypt (PyPI package) versions before 1.4.0 hardcode default JWT signing secrets in config.py that bypass validation checks. Anyone with source-code access can forge valid JWT tokens for any client_id, gaining authenticated access to keyserver and telemetry APIs. CVSS 3.1 score is 8.8 (H...

PT-2026-76629

openssl encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client id to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-64887 Airwall - Hardcoded Secrets

Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1...

CVE-2026-56271

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses weak hardcoded default JWT secrets 'authtoken', 'refreshtoken' and default audience and issuer values 'AUDIENCE', 'ISSUER' in the enterprise passport authentication middleware packages/server/src/enterprise/middleware/passport/index.t...

CVE-2026-33362

In Meari IoT SDK builds embedded in CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and white-label Android apps = 1.8.x latest observed, multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys...

CVE-2026-33362

In Meari IoT SDK builds embedded in CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and white-label Android apps = 1.8.x latest observed, multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys...

PT-2026-39644

In Meari IoT SDK builds embedded in CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and white-label Android apps = 1.8.x latest observed, multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys...

VibeGuard: A Security Gate Framework for AI-Generated Code

"Vibe coding," in which developers delegate code generation to AI assistants and accept the output with little manual review, has gained rapid adoption in production settings. On March 31, 2026, Anthropic's Claude Code CLI shipped a 59.8 MB source map file in its npm package, exposing roughly...