PT-2026-82228

Name of the Vulnerable Software and Affected Versions Bird Home Automation GmbH D1101V-F 000140 affected versions not specified Description Incorrect access control exists due to flaws in the key derivation process and the password validation process. Recommendations At the moment, there is no...

PT-2026-82215

Name of the Vulnerable Software and Affected Versions one-api affected versions not specified Description An issue exists in middleware/auth.go where one of two channel-pinning paths is not properly gated. While requests using a suffix on the API key require model.IsAdmin to succeed, requests usi...

CVE-2026-80198

Kimai versions before 2.56.0 fail to properly restrict the config() Twig function within sandboxed invoice and export templates. This allows users with admin privileges to upload malicious templates that read arbitrary configuration keys, potentially exfiltrating sensitive server-wide secrets suc...

Google-api-key-scanner

Übersicht Ein Python-Tool zum Testen von Google-Maps-API-Schlüsseln gegen 21 verschiedene Google-API-Endpunkte, um zu prüfen, welche Dienste offengelegt und verwundbar sind. !IMPORTANT 🎥 Für eine vollständige Vorführung des Tools schau dir das Demo-Video hier an: https://youtu.be/3KMUnLdlOSE. Das...

Gemini-api-key-hunter

Toolkit per chiavi API Gemini Un toolkit per scoprire, validare e testare chiavi API Google Gemini esposte. È composto da due componenti: Gemisc.py – Uno scanner Python ad alta velocità che scopre chiavi API Google esposte da siti web e file JavaScript, le verifica tramite l'API Gemini e identifi...

openssl: heap buffer overflow in CMS key unwrapping

A flaw was found in OpenSSL. A crafted CMS Cryptographic Message Syntax message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMSdecrypt. This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap...

zeek-xor-exe-plugin

================= Corelight::PEXOR XOR-ओबफ़स्केटेड Windows EXE का पता लगाने और डिक्रिप्ट करने के लिए Zeek प्लगइन। फ़ाइल को XOR करने के लिए उपयोग की गई कुंजी स्वचालित रूप से खोजी जाएगी और फ़ाइल को वापस मूल Windows निष्पादन योग्य में बदलने के लिए उपयोग की जाएगी। फ़ाइल डिओबफ़स्केट हो जाने के बाद, इस...

covert-tube

covert-tube A program to control systems remotely by uploading videos to Youtube using Python to create the videos and the listener, emulating some malware I was reading about. It allows to create videos with frames formed of simple text, QR codes with cleartext or QR codes using AES encryption...

GHSA-72F3-6W86-7RV3 @arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint

Summary The self-hosted HTTP transport of @arikusi/deepseek-mcp-server exposes POST /mcp without any authentication: createMcpExpressApp is called without an authProvider and no middleware guards the route, so any network-reachable client can issue an unauthenticated initialize request and obtain...

EUVD-2026-42717

@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint...

USN-8678-2: OpenSSL, OpenSSL 1.0 vulnerabilities

USN-8678-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL and OpenSSL 1.0 on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. In addition, this update also fixes the following issues that were not previously addressed in those releases: It was...

USN-8678-2 openssl, openssl1.0 vulnerabilities

USN-8678-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL and OpenSSL 1.0 on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. In addition, this update also fixes the following issues that were not previously addressed in those releases: It was...

key-transparency-auditor

key-transparency-auditor Uma implementação de referência de um auditor de terceiros para o serviço de transparência de chaves da Signal, com base na especificação de transparência de chaves. Visão geral Este serviço é escrito em Java usando o framework Micronaut. Para compilar e executar os teste...

USN-8678-1: OpenSSL vulnerabilities

It was discovered that OpenSSL incorrectly handled the QUIC server incoming channel queue. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. CVE-2026-14456 It was discovered that...

rtx-cve-2023-45779

Questo repository è fornito COSÌ COM'È per accompagnareuna divulgazione di vulnerabilità di Meta Red Team X. Non è un progetto ufficiale di Meta e non sarà supportato come tale. Un insieme di script e artefatti che dimostrano l'individuazione e lo sfruttamento di dispositivi Android che includono...

CVE-2026-24166

NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. A successful exploit of this vulnerability might lead to information disclosure and escalation of privileges...

CVE-2026-24166

NVIDIA UFM Enterprise has a vulnerability in its session management component caused by a hard-coded cryptographic key . An attacker with local access could exploit this to extract information, potentially leading to information disclosure and escalation of privileges . The CVSS 3.1 score is 5.1 ...

EUVD-2026-65612

NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. A successful exploit of this vulnerability might lead to information disclosure and escalation of privileges...

CVE-2026-79780

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-55539

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API createapp function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAIJOBSAPIKEY middleware f...