CVE-2025-53690-Analysis

CVE-2025-53690: Analisi della vulnerabilità di deserializzazione ViewState di Sitecore Panoramica CVE-2025-53690 è una vulnerabilità di deserializzazione ViewState scoperta nella famiglia di prodotti Sitecore, una vulnerabilità di sicurezza critica che consente l'esecuzione remota di codice...

Leaked-Credentials

Per cercare credenziali trapelate utilizzando gli strumenti di sviluppo di Google Chrome e le regex, segui questi brevi passaggi: 1. Apri DevTools: In Chrome, naviga sul sito che stai ispezionando, poi apri gli Strumenti di sviluppo con Ctrl+Shift+I Windows/Linux o Cmd+Option+I macOS. 2. Vai alla...

CVE-2026-80708 s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in ccaclr2cipherkey The helper function ipcprbhelper uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could lead ...

widevine-l3-decryptor

चेतावनी: अप्रचलन इस रिपॉजिटरी में पहले विंडोज मशीनों पर Chrome में Widevine L3 DRM को बायपास करने का कोड था। यह 31 मई 2021 से काम नहीं कर रहा है, लेकिन आप रिवर्सिंग राइटअप पढ़ सकते हैं। अपडेट Google ने इस रिपॉजिटरी के अधिकांश फोर्क्स के खिलाफ DMCA हटाने का अनुरोध जारी किया। उस समय रिपॉजिटरी की मू...

CVE-2026-81530

MongoDB C# Driver has a weakness in its client-side encryption configuration where KMS key-management credentials supplied by the application are serialized verbatim into the driver's human-readable diagnostic settings representation instead of being masked like other secret fields. An attacker w...

CVE-2026-81530 KMS master key exposure via unredacted credential serialization in driver settings string

A weakness in the client-side encryption configuration surface of the MongoDB C Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked...

KMS master key exposure via unredacted credential serialization in driver settings string

A weakness in the client-side encryption configuration surface of the MongoDB C Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked...

ledger-app-monero-1.42-vuln

CVE-2020-6861: Estrazione della chiave di spesa dell'app Ledger Monero Repository PoC per l'articolo: https://deadcode.me/blog/2020/04/25/Ledger-Monero-app-spend-key-extraction.html...

EUVD-2026-67088

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an...

CVE-2026-27944

CVE-2026-27944 Um script de prova de conceito para CVE-2026-27944, uma exploração crítica que permite que backups do nginx-ui sejam descriptografados AVISO LEGAL Esta Prova de Conceito destina-se apenas a fins educacionais e de testes de segurança ética. Foi desenvolvida para demonstrar a causa...

CYBERDUDEBIVASH-5G-Core-Key-Rotation-Ghost-Admin-Auditor

CYBERDUDEBIVASH Rotazione Chiavi 5G Core & Auditor Ghost Admin v1.1 © 2026 CYBERDUDEBIVASH – Tutti i diritti riservati Autorità Globale nella Sicurezza 5G Zero-Trust e Reti Private Bhubaneswar, Odisha, India Strumento di livello produttivo per rilevare e correggere CVE-2026-0622 privilege...

threat-intel-brief-cve-2026-42208-litellm

Threat Intelligence Brief - CVE-2026-42208: BerriAI LiteLLM SQL Injection CVE: CVE-2026-42208 GHSA: GHSA-r75f-5x8p-qvmc CVSS Score: 9.3 Critical Affected Software: BerriAI LiteLLM versions = 1.81.16, 1.83.7 Fixed Version: 1.83.7-stable released April 19, 2026 CISA KEV Added: May 08, 2026 Sources:...

git-hound

🐾 GitHound Um apanhador de segredos que combina padrões, ataca patches e captura em lote. Visão Geral O GitHound caça chaves de API, segredos e credenciais expostas no GitHub combinando GitHub dorks com correspondência de padrões, detecção contextual e análise do histórico de commits. Insira um...

CVE-2026-81027

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the...

CVE-2026-29988

Milesight IoT devices (multiple models, affected firmware versions) are vulnerable to cleartext transmission of sensitive information through the NFC interface. An unauthenticated attacker with physical proximity can read LoRaWAN ABP NwkSKey , AppSKey , and D2D keys via a simple NFC read operatio...

EUVD-2026-66229

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...

EUVD-2026-66228

duplicate record...

GHSA-72F3-6W86-7RV3 @arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint

Summary The self-hosted HTTP transport of @arikusi/deepseek-mcp-server exposes POST /mcp without any authentication: createMcpExpressApp is called without an authProvider and no middleware guards the route, so any network-reachable client can issue an unauthenticated initialize request and obtain...

CVE-2026-78555

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555

RansomLook embedded complete API keys in hidden HTML form fields on the authenticated /admin/apikeys administration page, while the UI displayed only a shortened representation. The full tokens were included in forms for enable/disable, private-access, and delete actions, making them recoverable ...