CVE-2026-107785 Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiated

Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 bytes instead of the 32 bytes WireGuard requires. The agent does not validate this size; instead it attempts to use the wg s...

CVE-2026-107785

Crux Agent versions 1.9.0 before 2.0.3 are vulnerable to a silent failure during SKA preshared key rotation . When a peering session negotiates SHA-512 , the agent generates a 64-byte key instead of the 32 bytes required by WireGuard. Because the agent fails to validate this size, it attempts to ...

virustotalx

エンドポイント向け virustotalx IP向け virustotalx V2 インストール git clone https://github.com/orwagodfather/virustotalx.git cd virustotalx 3つのアカウントを https://www.virustotal.com/gui/join-us で作成し、3つのAPIキーをコピーしてください === nano orwa.sh & nano orwaV2.sh ここに3つのAPIキーを貼り付けてください .... if $apikeyindex -eq 1 ; then...

CYBERDUDEBIVASH-5G-Core-Key-Rotation-Ghost-Admin-Auditor

CYBERDUDEBIVASH 5Gコア鍵ローテーション＆ゴースト管理者監査ツール v1.1 © 2026 CYBERDUDEBIVASH – 全著作権所有 ゼロトラスト5G＆プライベートネットワークセキュリティの世界的権威 インド、オディシャ州、ブバネシュワル 5GコアソフトウェアにおけるCVE-2026-0622（ゴースト管理者の権限昇格＆マスター鍵の露出）を検出・修復するための本番環境対応ツール。 特徴 ゼロトラストAPI認証 ゴースト管理者イベント検出（NRFログ） マスター鍵ローテーション状態チェック（UDM/AUSF） 緊急強制鍵ローテーション（プレミアム）...

magento2-encryption-key-manager-cli

Magento 2 Encryption Key Manager CLI Magento 2の暗号化キーのローテーションと管理のためのユーティリティです。CVE-2024-34102通称 Cosmic Stingの被害者は、アフターケアとして使用できます。 対象 開発での使用 デプロイ自動化 CVE-2024-34102通称 Cosmic Stingのアフターケア CVE-2024-34102通称 Cosmic Sting セキュリティパッチ適用後、攻撃者によるAdminレベルのWebAPIアクセスを完全に拒否するために、キーローテーションを実行する必要があります。...

CVE-2026-100615 Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikeymanager to rotate a higher-privileged orgsuperadmin sibling key and recover its plaintext credential. Attackers with apikeymanager role can enumerate same-owner API keys, rotate a strong...

CVE-2026-100615 Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikeymanager to rotate a higher-privileged orgsuperadmin sibling key and recover its plaintext credential. Attackers with apikeymanager role can enumerate same-owner API keys, rotate a strong...

CVE-2026-100615

Versions of Cap-go capgo.app prior to 12.267.1 are vulnerable to a privilege escalation flaw because the system fails to validate target API key privileges during the rotation process. An attacker with the apikey_manager role can enumerate API keys owned by the same entity and use the PUT endpoin...

CVE-2026-100615 Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikeymanager to rotate a higher-privileged orgsuperadmin sibling key and recover its plaintext credential. Attackers with apikeymanager role can enumerate same-owner API keys, rotate a strong...

PT-2026-99286

Name of the Vulnerable Software and Affected Versions capgo.app versions prior to 12.267.1 Description Insufficient validation of API key privileges during the rotation process allows a user with the apikey manager role to rotate a sibling key belonging to a higher-privileged org super admin. By...

CVE-2026-82356

Imprivata EAM =26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices...

EUVD-2026-85537

Imprivata EAM =26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices...

CVE-2026-82356 Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production

Imprivata EAM =26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices...

CVE-2026-82356: Inadequate Encryption Strength

Imprivata EAM =26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices...

Enterprise Access Management EAM does not rotate RSA keys

Overview Imprivata Enterprise Access Management EAM, an authentication and single sign-on platform for enterprise and clinical environments, contains a vulnerability in versions 26.2.6 and below. The product provides no supported mechanism to rotate its RSA key pair after deployment, meaning the...

Malicious code in sams-text-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f81a7140e2d1a61a8bb4c6594ad8b75cadab20788d22005d9bf026d834c2e626 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16090 Malicious code in sams-run-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14b995469abba673b875788358966c5468456f0a911b1f6e3b5ee95c8f14afb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16066 Malicious code in @haimiya/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afb1fac619ba416b14b747307762d4e4cf1cfc41f00a244c8e472af5f689deb0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16042 Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

Malicious code in @idkruan-10/dpd-depconf-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bf846560a10c8a741e6acdc52828666f0f665f5770a2e01e8531341ef9dc4a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...