CVE-2026-61670 microsandbox: Secret values exposed in world-readable process arguments

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandboxcmd.rs...

Arisu

Arisu — AI Key 自动化采矿系统 Arisu 是一款自动扫描公开代码仓库（GitHub、GitLab、Gitee、Docker Hub、PyPI、npm 等）和代码片段（Gist、Issues、CommonCrawl），提取 AI 服务 API 密钥（DeepSeek、OpenAI、Anthropic、Kimi 等）并验证其有效性及余额的工具。提供 TUI 仪表板和多种输出格式（JSON、CSV、Markdown）。 功能特性 🔍 多源扫描 ：GitHub 代码搜索、Sourcegraph、Gist、Issues、GitLab、Gitee、Docker...

AWS-Key-Hunter

AWS-Key-Hunter AWS Key Hunter is a powerful and automated tool that scans GitHub repositories for exposed AWS keys. It continuously monitors commits, detects AWS secrets in both base64 and plaintext formats, and alerts users about potential security risks on Discord. Features 🚀 Real-time...

invoker

Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...

aquatone

AQUATONE Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface. Installation 1. Install Google Chrome or Chromium browser -- Note: Google Chrome is currently giving unreliable results when...

gitrob

Gitrob: Putting the Open Source in OSINT Gitrob is a tool to help find potentially sensitive files pushed to public repositories on Github. Gitrob will clone repositories belonging to a user or organization down to a configurable depth and iterate through the commit history and flag files that...

meshtastic-cve-2025-52464-poc

Meshtastic CVE-2025-52464 概念验证 概述 本项目是一个纯软件概念验证，演示 CVE-2025-52464 ，这是影响 Meshtastic 固件版本 2.5.0 至 2.6.10 的一个漏洞。 该实现复现了受影响固件的加密行为，并演示了重复或低熵的加密密钥如何使攻击者能够解密加密的直接消息（DM）。它还演示了固件版本 2.6.11 中引入的修复行为，在该版本中，正确的密钥生成和低熵密钥检测可阻止此类攻击。 项目结构 root@kitploit: cryptoengine.py Cryptographic operations X25519, HKDF,...

DumpsterDiver

DumpsterDiver by @Rzepsky DumpsterDiver is a tool, which can analyze big volumes of data in search of hardcoded secrets like keys e.g. AWS Access Key, Azure Share Key or SSH keys or passwords. Additionally, it allows creating a simple search rules with basic conditions e.g. report only csv files...

trommel

TROMMEL TROMMEL sifts through embedded device files to identify potential vulnerable indicators. TROMMEL identifies the following indicators related to: Secure Shell SSH key files Secure Socket Layer SSL key files Internet Protocol IP addresses Uniform Resource Locator URL email addresses shell...

socialhunter

socialhunter !IMPORTANT This tool is no longer working, and we won't be able to fix it as it has become difficult to bypass social media protections. Crawls the given URL and finds broken social media links that can be hijacked. Broken social links may allow an attacker to conduct phishing attack...

AspDotNetWrapper-Edited-

AspDotNetWrapper 用于测试 ASP.NET 中的 viewstate 机器密钥 下载 在 Windows 中克隆并解压文件 使用方法 root@kitploit: AspDotNetWrapper.exe --keypath MachineKeys.txt --encrypteddata --decrypt --purpose=viewstate --modifier= --macdecode 将 替换为 viewstate= 参数的 value in the source 将 替换为 VIEWSTATEGENERATOR= 参数的 value in the source...

CVE-2025-15545

CVE-2025-15545 Information Vendor: TP-Link Vendor's website: TP-Link Model: Archer RE605X Hardware version: RE605X v3.0 Firmware version: RE605XEUV31.1.5 Build 20240905 Firmware download address: TP-Link A chain of vulnerabilities — including the use of hardcoded cryptographic keys and a command...

EulerOS 2.0 SP10 : python-jwt (EulerOS-SA-2026-3761)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

JFrog Artifactory 7.161.x < 7.161.16 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is 7.161.x prior to 7.161.16. It is, therefore, affected by the following vulnerabilities. - An authentication weakness that, under default configuration, may allow an unauthenticated...

CVE-2025-69428

Security Advisory - CVE-2025-69428 Title: Unauthenticated Access to Sensitive Directory Information Disclosure CVE-ID: CVE-2025-69428 Description A critical access control vulnerability in locally deployed Pro-Bit application in versions less than v1.77.4 allows unauthenticated attackers to...

CVE-2025-60791

CVE-2025-60791 CVE-2025-60791: Cleartext Storage of Sensitive Information in Memory. Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The...

CVE-2026-92758 Logs may collect sensitive information

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...

CVE-2026-92758

This MongoDB -related vulnerability occurs when the application logging mode is set to DEBUG or a malformed MongoDB connection string is used, causing application logs to capture sensitive information such as passwords and AWS secure access keys. The root cause is overly verbose or misconfigured ...

CVE-2026-92758 Logs may collect sensitive information

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...

Logs may collect sensitive information

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...