mantra

「🔑」 关于 Mantra 本工具使用 Go 编写，主要目标是搜索 JavaScript 文件和 HTML 页面中的 API 密钥。 它的工作原理是检查网页和脚本文件的源代码，查找与 API 密钥相同或相似的字符串。这些密钥通常用于对第三方 API 等在线服务进行身份验证，属于机密信息，不应公开共享。 通过使用此工具，开发者可以快速发现 API 密钥是否泄露，并在密钥被滥用前采取措施修复问题。此外，安全人员也可利用它来验证使用外部 API 的应用程序和网站是否对其密钥进行了充分保护。 总之，本工具是帮助保护 API 密钥、防止敏感信息泄露的高效且精准的解决方案。 帮助 使用 安装 通过...

CVE-2026-18040 HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler

In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF2^8 arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a...

CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-23006-Kyber-Ciphertext-Length-Side-Channel

CVE-2026-23006 – Canal lateral de longitud de texto cifrado de Kyber Código del programa Python kyberlengthleak.py - Leaks secret key bit based on ciphertext length import random Simulate encapsulation: ciphertext length depends on message bit def encapsulatepk, bit: In a flawed implementation, t...

HTB-Snapped-Writeup

HTB-Snapped-Writeup Writeup de la máquina HTB Snapped — Linux de dificultad Hard. CVE-2026-27944 divulgación de copia de seguridad no autenticada en Nginx UI encadenada con CVE-2026-3888 condición de carrera en snapd para escalada de privilegios local para lograr el compromiso total del sistema...

CVE-2025-11203-PoC

CVE-2025-11203 — Divulgación de información de APIKEY en el endpoint Health de LiteLLM En LiteLLM versiones 1.63.14, el endpoint /health, al procesar el parámetro apikey, no filtra correctamente la información sensible , lo que permite que los usuarios autenticados obtengan las API Key almacenada...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nss (UTSA-2026-090161)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090161 advisory. When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during...

EUVD-2026-81266

RMCP: Custom HTTP headers leak to cross-origin redirect targets...

EUVD-2026-78589

Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of requiring the input host to be an exact member of SUPPORTEDDOMAINS, and then reuses that input host for API requests. When a Pixeldrain A...

CVE-2026-54254 Cyberdrop-DL: Pixeldrain API key shared with unverified thirdparty sites

Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of requiring the input host to be an exact member of SUPPORTEDDOMAINS, and then reuses that input host for API requests. When a Pixeldrain A...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: ecdh – explicitly zeroes privatekey. The privatekey is overwritten with the key parameter passed in by the caller if present, or alternatively with a newly generated private key. However, it is possible that the caller...

Astra Linux – Vulnerability in mbedtls

A timing side channel in mbedtlsssldecryptbuf in library/sslmsg.c in Trusted Firmware Mbed TLS from version 2.23.0 allows an attacker to obtain secret key information. This issue affects the CBC mode, as it involves a calculated time difference based on the padding length...

Astra Linux – Vulnerability in mbedtls

Before version 2.16.5 of Arm Mbed TLS, attackers could obtain sensitive information an RSA private key by monitoring cache usage during an import process...

CVE-2026-85178 Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter

Helicone's VaultManager.getDecryptedProviderKeyById function in the GET /v1/vault/key/providerKeyId endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream...

CVE-2026-81027 one-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinning

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the...

JetBrains TeamCity < 2022.04.2 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2022.04.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases CVE-2022-36321 - In JetBrains TeamCity before...

CVE-2026-75915

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...

CVE-2026-57485

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

CVE-2026-74900

openssl_encrypt before version 1.4.0 has a flaw in pqc.py: when KEM decapsulation fails, it silently falls back to simulation mode, deriving a deterministic shared secret from just 16 bytes of the private key plus public encapsulated key data. An attacker with those 16 private-key bytes can compu...