CVE-2026-33032-nginx-ui-vuln-lab

CVE-2026-27944 + CVE-2026-33032 — Laboratorio RCE sin Credenciales en nginx-ui Aviso legal: Este repositorio está destinado únicamente a fines educativos y de investigación de seguridad autorizada. Todas las técnicas demostradas aquí solo deben utilizarse contra sistemas que poseas o para los que...

CVE-2026-92132

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

SmartSearchWP < 2.4.6 - OpenAI Key Disclosure

The plugin does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key. id: CVE-2024-6845 info: name: SmartSearchWP 2.4.6 - OpenAI Key Disclosure author: s4e-io severity: medium...

keepass_dump

Keepass-Dumper 这是我对 CVE-2023-32784 的概念验证实现。 我的版本是 @vdohney 的 PoC 的 Python 移植，并做了一些更改和额外功能。 变更 一项变更是使用转储文件中可找到的已知字符串，以便更准确地跳转至主密钥字符所在位置。这减少了假阳性字符，并大大缩短了扫描文件所需的时间。如果转储文件中未找到这些字符串，扫描将从文件开头开始。此选项默认启用，但若希望执行完整扫描，可使用 --full-scan。对于此类情况，我还添加了 --skip 标志以加快扫描速度。原理是通过偏移指针跳过接下来的 1000...

CVE-2026-46395-haxcms-hmac-key-leak

CVE-2026-46395 - HAXcms Node.js 因 HMAC 缺陷导致的私钥泄露 CWE-321 / CWE-200 仅限授权安全测试与研究的概念验证。 此处描述的漏洞已在 HAXcms 最新版本中修复 。 本 PoC 的发布是为了让防御者和研究人员能够在其拥有或明确授权测试的未打补丁实例上验证此问题。...

CVE-2026-82432

Apache Storm Nimbus contains an authorization bypass in its blobstore handling. The topology.blobstore.map field was validated against the calling subject only at topology submission time; the rebalance operation accepted configuration overrides but never re-ran that validation. A caller authoris...

CVE-2026-90933 laradashboard through 1.2.2 Missing Authorization via License API

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...

FOSKiller

root@kitploit: ███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║...

CVE-2026-87779 Apache Syncope: AES Secret Key disclosure via log output

Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length not 16/24/32 bytes is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Syncope: from 3.0.15...

CVE-2026-53519-PoC

CVE-2026-53519 — Path Traversal y falsificación de JWT en Nezha Dashboard English | 繁體中文 | 简体中文 Este repositorio contiene un exploit de Prueba de Concepto PoC para una vulnerabilidad en el Nezha Dashboard que permite path traversal sin autenticación , lo que conduce a la divulgación de archivos...

ledger-app-monero-1.42-vuln

CVE-2020-6861：Ledger Monero 应用花费密钥提取 文章对应的 PoC 仓库： https://deadcode.me/blog/2020/04/25/Ledger-Monero-app-spend-key-extraction.html...

WordPress SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin < 4.7.40 - Subscriber+ TLS Private Key Disclosure vulnerability

Subscriber+ TLS Private Key Disclosure vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin SSL Zen versions 4.7.40...

EUVD-2026-57461

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking...

GHSA-8X84-R2FF-H8PQ SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

CVE: This vulnerability corresponds to CVE-2026-72801. Summary Two CheckAuth-only endpoints disclose the complete offline attack material for the encrypted-notebook master password, plus the wrapped per-notebook key needed to use it. Both are reachable by the publish RoleReader token and by the...

CVE-2026-85175 SiYuan before v3.8.2 TLS Private Key Disclosure via getFile

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

CVE-2026-85175

SiYuan versions ≤ 3.8.1 contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go) that only blocks conf/conf.json by exact match but fails to restrict the TLS private key (conf/key.pem) and CA private key (conf/ca.key). Because the getFile handler skips the ...

CVE-2026-85175 SiYuan before v3.8.2 TLS Private Key Disclosure via getFile

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

CVE-2026-82639

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...

CVE-2026-82639 NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...

CVE-2026-82639

NextChat versions 2.15.8 through 2.16.1 are affected by an improper URL validation flaw in the proxy endpoint . The x-base-url header is validated via substring matching rather than proper hostname parsing, so any attacker-supplied URL containing the string api.openai.com passes validation. This ...