CVE-2025-1234-RSA-Key-Validation-Bypass

CVE-2025-1234-RSA-Key-Validation-Bypass Una falla en una implementación RSA popular permite a los atacantes eludir la validación de clave proporcionando un módulo que parece válido pero que en realidad es factorizable — si puedes factorizarlo rápidamente. CVE‑2025‑1234 — Exploit de Omisión de...

keyhacks

KeyHacks muestra métodos para validar diferentes claves de API encontradas en un programa Bug Bounty o una prueba de penetración. @Gwen001 ha automatizado todo el proceso disponible aquí y se puede encontrar aquí Tabla de Contenidos Clave de API de ABTasty Clave de API de Algolia Claves de API de...

Gemini-api-key-hunter

Gemini API Key Toolkit A toolkit for discovering, validating, and testing exposed Google Gemini API keys. It consists of two components: Gemisc.py – A high-speed Python scanner that discovers exposed Google API keys from websites and JavaScript files, verifies them against the Gemini API, and...

CVE-2023-54355

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...

EUVD-2023-60620

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...

CVE-2026-80339 Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

EUVD-2026-74619

An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions P256,P384,P521.Dsa.pubofoctets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key...

EUVD-2026-73949

In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28590

CVE-2026-28590 is a Critical severity vulnerability in the Android operating system and Media Framework , caused by an improper encryption key validation due to a logic error in multiple code locations. The flaw enables local escalation of privilege with no additional execution privileges require...

CVE-2026-82060

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...

CVE-2026-82060

CVE-2026-82060 is an insufficient validation flaw in MongoDB Server affecting sharded collections. During document insertion, shard key values were not properly validated, allowing authenticated users to store operator-shaped objects as shard key values. When change stream events for such documen...

Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...

EUVD-2026-72024

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...

Linux Distros Unpatched Vulnerability : CVE-2026-85394

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH...

EUVD-2026-70671

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

CVE-2026-85394

python-jose through version 3.5.0 contains an algorithm confusion vulnerability in its HMAC key validation logic. The library fails to properly reject DER-encoded public keys that lack PEM armor or SSH prefixes, allowing them to be accepted as HMAC secrets. An attacker who possesses the service's...

ASB-A-483126552

In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098914)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098914 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser rsahelper.c bounds ea...

EUVD-2026-65298

The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.11 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an...

CVE-2026-18051 W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...