run-gemini-cli

run-gemini-cli Übersicht run-gemini-cli ist eine GitHub Action, die Gemini über die Gemini CLI in deinen Entwicklungsworkflow integriert. Sie fungiert sowohl als autonomer Agent für kritische routinemäßige Programmieraufgaben als auch als bedarfsorientierter Mitarbeiter, dem du schnell Aufgaben...

cariddi

Prendi una lista di domini, esegui il crawling degli URL e scansiona per endpoint, segreti, chiavi API, estensioni di file, token e altro ancora Codice con 💙 da edoardottt Condividi su Twitter! Installazione • Utilizzo • Per iniziare • Changelog • Contribuire • Licenza Installazione 📡 Homebrew...

DRUPAL-CONTRIB-2026-110

This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not sufficiently restrict repeated attempts to guess that key, allowing brute-force attacks against the access-control mechanism...

CVE-2026-32593

Winter CMS (Laravel-based PHP CMS) versions up to 1.2.12 are vulnerable to SQL injection in the backend Filter widget (Backend\Widgets\Filter) when the numberrange scope type is configured with a conditions key. Filter values are interpolated into the conditions statement without parameter bindin...

CVE-2026-32593 Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions key, allowing an authenticated backend...

aes-finder

AES Finder Utility to find AES keys in running process memory. Works for 128, 192 and 256-bit keys. Usage Open aes-finder.sln solution in Visual Studio 2013 to compile source. Alternatively use gcc/clang: root@kitploit: g++ -O3 -march=native -fomit-frame-pointer aes-finder.cpp -o aes-finder To...

telegram-nearby-map

Telegram Nearby Map Telegram Nearby Map uses OpenStreetMap and the official Telegram library to find the position of nearby users. Please note: Telegram's API was updated a while ago to make nearby user distances less precise, preventing exact location calculations. Therefore, Telegram Nearby Map...

RemoteMonologue

RemoteMonologue RemoteMonologue è una tecnica di raccolta di credenziali Windows che consente il compromesso di utenti remoti sfruttando la chiave RunAs Interactive User e forzando autenticazioni NTLM tramite DCOM. Leggi RemoteMonologue: Weaponizing DCOM for NTLM Authentication Coercions di X-For...

CVE-2026-81027

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

CVE-2026-80520

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missing key ovpncryptokillkey assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the...

CVE-2026-74750

In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto freeing to workqueue Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU callback. That is not safe for all crypto implementations: cryptofreeaead...

CVE-2026-80520 ovpn: fix NULL dereference when killing missing key

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missing key ovpncryptokillkey assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the...

CVE-2026-80520

A NULL pointer dereference in the Linux kernel's ovpn (OpenVPN) module can lead to a denial of service (CVSS 3.1: 7.5, HIGH). The function ovpn_crypto_kill_key assumes both crypto slots are populated and dereferences each before checking for NULL. Since a peer can have only one installed key, the...

kas Persistently Disables SSH Host Key Checking

Summary kas persistently disables SSH host key checking for the invoking user when internal SSH key setup is triggered via SSHPRIVATEKEY or SSHPRIVATEKEYFILE and no user-specific SSH configuration file exists so far. When this path is used, kas creates /.ssh/config with a global Host rule...

EUVD-2026-66560

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

CVE-2026-54548

kas is a setup tool for bitbake-based projects. Prior to version 5.4 , when internal SSH key setup is triggered via SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE and no user-specific SSH configuration exists, the function ssh_no_host_key_check() in kas/libcmds.py creates ~/.ssh/config with a global Hos...

CVE-2026-54548 kas: Persistent SSH Host Key Checking Disablement

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...