Gemini-api-key-hunter

Gemini APIキーツールキット 公開されたGoogle Gemini APIキーを発見、検証、テストするためのツールキットです。 2つのコンポーネントで構成されています： Gemisc.py – WebサイトやJavaScriptファイルから公開されたGoogle APIキーを発見し、Gemini APIに対して検証し、各キーがアクセスできるサービスを特定する高速Pythonスキャナーです。 lostsec.html – 発見したAPIキーを使用してGemini APIと直接やり取りできるブラウザベースのGeminiクライアントです。バックエンドやサーバーは不要です。...

keyhacks

KeyHacks는 버그 바운티 프로그램이나 침투 테스트에서 발견된 다양한 API 키를 검증하는 방법을 보여줍니다. @Gwen001가 전체 프로세스를 스크립트로 작성했으며, 여기에서 찾을 수 있습니다. 목차 ABTasty API 키 Algolia API 키 Amplitude API 키 Asana 액세스 토큰 AWS 액세스 키 ID 및 시크릿 Azure Application Insights 앱 ID 및 API 키 Bazaarvoice 패스키 Bing Maps API 키 Bit.ly 액세스 토큰 Branch.io 키 및 시크릿...

9router <=0.5.4 - Authentication Bypass

9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation...

CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

CVE-2025-1234-RSA-Key-Validation-Bypass

CVE-2025-1234-RSA-Key-Validation-Bypass 널리 사용되는 RSA 구현의 결함으로 인해 공격자가 유효해 보이지만 실제로는 인수분해 가능한 모듈러스를 제공하여 키 검증을 우회할 수 있습니다. — 물론 빠르게 인수분해할 수 있다면 말이죠. CVE‑2025‑1234 — RSA 키 검증 우회 익스플로잇 ctt-pnp-solver를 사용하여 취약한 RSA 모듈러스를 몇 초 만에 인수분해하는 개념 증명 익스플로잇입니다. 영향 이 익스플로잇은 CVE‑2025‑1234가 수렴 시간 이론Convergent Time...

EUVD-2026-44813

9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding...

CVE-2026-56681 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip...

CVE-2026-56681: Reliance on Untrusted Inputs in a Security Decision

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip...

DEBIAN-CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

EUVD-2026-83258

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

EUVD-2026-76284

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset keynum and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset keynum drives cacheksetcrc and the replay loop in cachereplay, the writeback worker and the GC worker,...

CVE-2023-54355

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...

EUVD-2023-60620

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...

CVE-2023-54355 PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...

Exploit for CVE-2026-67276

RouterOS SSH Modulus-Confusion Validator CVE-2026-67276 An...

CVE-2026-80339 Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

EUVD-2026-74619

An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions P256,P384,P521.Dsa.pubofoctets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key...

Linux Distros Unpatched Vulnerability : CVE-2026-82060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted,...

EUVD-2026-73949

In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28590

This vulnerability affects the core Android operating system and the Media Framework . It is caused by a logic error leading to improper encryption key validation in multiple locations. Successful exploitation can result in local escalation of privilege without requiring additional execution priv...