CVE-2026-41729

CVE-2026-41729: Spring Data REST JSON Patch Map Key SpEL Injection PoC Questo repository è una PoC minima di riproduzione per CVE-2026-41729, pubblicata tramite l'avviso di sicurezza ufficiale di Spring. Avviso ufficiale: https://spring.io/security/cve-2026-41729/ Titolo ufficiale: Spring Data RE...

jwt-spoof-tool

jwt-spoof-tool Tool Beschreibung : Ich habe dieses Tool zu Lernzwecken und zur Automatisierung des JWT-Token-Hijackings erstellt, ohne auf BurpSuite angewiesen zu sein. Der Code ist gut dokumentiert und leicht nachvollziehbar. Basierend auf CVE-2018-0114 Die Sicherheitslücke entsteht, weil der...

ssh-hardening

SSH-Härtung SSH auf Debian/Ubuntu in einem Durchgang absichern: neuer Port, kein Root-Login, schlüsselbasierte Authentifizierung, optional UFW und Fail2Ban. Was Sie sehen werden Wenn Sie das Skript ausführen, erkennt es Ihr Betriebssystem und zeigt die Einstellungen an, bevor es fragt, ob Sie...

CVE-2026-19718 BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...

CVE-2026-19718

CVE-2026-19718 affects three WordPress plugins — BlogVault Backup & Staging , MalCare WordPress Security , and The WP Remote (versions 5.16–6.62) — where a weak pseudo-random number generator is used to create the connection key secret that binds a site to its remote management service. Unauthent...

CVE-2026-29988

Milesight IoT devices (multiple models, affected firmware versions) are vulnerable to cleartext transmission of sensitive information through the NFC interface. An unauthenticated attacker with physical proximity can read LoRaWAN ABP NwkSKey , AppSKey , and D2D keys via a simple NFC read operatio...

EUVD-2026-66229

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...

EUVD-2026-66228

duplicate record...

EyesOfNetwork - Hardcoded API Key & SQL Injection

An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/apifunctions.php. id: CVE-2020-8656 info: name:...

CVE-2023-42179

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control through its key derivation process and password validation process. This could allow unauthorized parties to gain access to the device by exploiting weaknesses in how keys are derived or passwords are validated. N...

EUVD-2023-60608

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process...

Broken access control in dashboard snapshots

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot’s secret delete key using only its public share key broken access control...

PT-2026-82228

Name of the Vulnerable Software and Affected Versions Bird Home Automation GmbH D1101V-F 000140 affected versions not specified Description Incorrect access control exists due to flaws in the key derivation process and the password validation process. Recommendations At the moment, there is no...

PT-2026-82215

Name of the Vulnerable Software and Affected Versions one-api affected versions not specified Description An issue exists in middleware/auth.go where one of two channel-pinning paths is not properly gated. While requests using a suffix on the API key require model.IsAdmin to succeed, requests usi...

CVE-2026-80198

Kimai versions before 2.56.0 fail to properly restrict the config() Twig function within sandboxed invoice and export templates. This allows users with admin privileges to upload malicious templates that read arbitrary configuration keys, potentially exfiltrating sensitive server-wide secrets suc...

CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature

CVE-2026-22001 – Falsificazione di firma per debole casualità in SPHINCS+ WOTS+ Panoramica Un'implementazione dello schema di firma post‑quantum SPHINCS+ utilizza un generatore di numeri casuali difettoso durante la generazione delle firme WOTS+. Lo stesso nonce k viene riutilizzato su più firme,...

Google-api-key-scanner

Übersicht Ein Python-Tool zum Testen von Google-Maps-API-Schlüsseln gegen 21 verschiedene Google-API-Endpunkte, um zu prüfen, welche Dienste offengelegt und verwundbar sind. !IMPORTANT 🎥 Für eine vollständige Vorführung des Tools schau dir das Demo-Video hier an: https://youtu.be/3KMUnLdlOSE. Das...

Gemini-api-key-hunter

Toolkit per chiavi API Gemini Un toolkit per scoprire, validare e testare chiavi API Google Gemini esposte. È composto da due componenti: Gemisc.py – Uno scanner Python ad alta velocità che scopre chiavi API Google esposte da siti web e file JavaScript, le verifica tramite l'API Gemini e identifi...

CVE-2026-22020-Weak-Seed-in-Quantum-Key-Distribution-Error-Correction

CVE-2026-22020 – Schwacher Seed in der Fehlerkorrektur der Quantenschlüsselverteilung Programmcode Python root@kitploit: qkdweakseed.py - Simulated QKD privacy amplification with weak seed import hashlib, os, time def privacyamplificationsiftedkey, seed: Weak: seed derived from current time,...

openssl: heap buffer overflow in CMS key unwrapping

A flaw was found in OpenSSL. A crafted CMS Cryptographic Message Syntax message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMSdecrypt. This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap...