SmartSearchWP < 2.4.6 - OpenAI Key Disclosure

The plugin does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key. id: CVE-2024-6845 info: name: SmartSearchWP 2.4.6 - OpenAI Key Disclosure author: s4e-io severity: medium...

keepass_dump

Keepass-Dumper This is my PoC implementation for CVE-2023-32784 My version is a python port of @vdohney's PoC along with a few changes and additional features. Changes One change, was to use known strings that can be found within the dump file in order to more accurately jump to the location of t...

CVE-2026-46395-haxcms-hmac-key-leak

CVE-2026-46395 - HAXcms Node.js Private Key Disclosure via Broken HMAC CWE-321 / CWE-200 Proof-of-concept for authorized security testing and research only. The vulnerability described here is fixed in the latest release of HAXcms. This PoC is published so that defenders and researchers can verif...

CVE-2026-53519-PoC

CVE-2026-53519 — Nezha Dashboard Path Traversal & JWT Forgery English | 繁體中文 | 简体中文 This repository contains a Proof-of-Concept PoC exploit for a vulnerability in the Nezha Dashboard that allows unauthenticated path traversal , leading to disclosure of sensitive files including jwtsecretkey and...

CVE-2026-82639

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...

CVE-2026-82639

NextChat versions 2.15.8 through 2.16.1 are affected by an improper URL validation flaw in the proxy endpoint . The x-base-url header is validated via substring matching rather than proper hostname parsing, so any attacker-supplied URL containing the string api.openai.com passes validation. This ...

CVE-2026-82639 NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...

CVE-2026-82639 NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...

FOSKiller

root@kitploit: ███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║...

WordPress Quiz and Survey Master (QSM) plugin < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure vulnerability

Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Quiz And Survey Master versions 11.2.4...

CVE-2026-51634

Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

ledger-app-monero-1.42-vuln

CVE-2020-6861: Estrazione della chiave di spesa dell'app Ledger Monero Repository PoC per l'articolo: https://deadcode.me/blog/2020/04/25/Ledger-Monero-app-spend-key-extraction.html...

CVE-2026-75573

CVE-2026-75573 affects mongodrdl , the data replication daemon in MongoDB Connector for BI . The root cause is that when a TLS private-key password is supplied both via the connection URI and the corresponding command-line option, mongodrdl may write that password to standard error . A local atta...

CVE-2026-75573 MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclos...

CVE-2026-69247

A flaw was found in cryptography, a Python package for cryptographic primitives. This vulnerability, known as a Bleichenbacher oracle, arises during PKCS7 EnvelopedData decryption. An attacker can exploit distinguishable error messages and timing differences during decryption to gain information...

CVE-2026-33032-nginx-ui-vuln-lab

CVE-2026-27944 + CVE-2026-33032 — nginx-ui Zero-Credential RCE Lab Haftungsausschluss: Dieses Repository dient ausschließlich Bildungs- und autorisierten Sicherheitsforschungszwecken. Alle hier demonstrierten Techniken sollten nur gegen Systeme eingesetzt werden, die Ihnen gehören oder für die Si...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-44252

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...

EUVD-2026-62551

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...